CVE-2026-0257PAN-OS GlobalProtect accepts forged authentication override cookies
What broke
GlobalProtect can issue an authentication override cookie so a user who has signed in once does not sign in again on every connection. Palo Alto Networks' advisory, published May 13, 2026, says PAN-OS relied on that cookie without validating its integrity (CWE-565), which let an attacker "bypass security restrictions and establish an unauthorized VPN connection." Only portals with "Generate cookie for authentication override" or "Accept cookie for authentication override" enabled, or gateways accepting the cookie, together with a specific certificate configuration, are exposed. Panorama and Cloud NGFW are not affected. Fixes ship in 12.1.7, 11.2.12, 11.1.15 and 10.2.18-h6 and in the hotfix builds the advisory lists. NVD scores it CVSS 3.1 9.1; the vendor's CVSS 4.0 score is 7.8.
CISA added it to KEV on May 29, 2026 and marks it as used in ransomware campaigns. Unit 42 reported in October 2026 that Qilin and INC operators used it to get a VPN session past MFA, then moved laterally over RDP and SMB. In one case they pivoted to vCenter and dumped credentials offline from a domain controller's virtual disk.
Why it matters
The cookie stands in for the whole login. A gateway that accepts it skips the password, the IdP redirect and the MFA prompt, so a forgeable cookie means anyone can arrive as a connected user. MFA on the VPN does nothing once the step that checks it is optional. See the breach database record and our October 2026 coverage.
What to do
- Upgrade PAN-OS to a fixed build. Users re-authenticate once after the upgrade.
- Until then, use a dedicated certificate for authentication override cookies that is not shared with the portal, the gateway or any other feature, or turn authentication override off on both portal and gateway.
- Hunt GlobalProtect logs for gateway-connected events with placeholder host IDs or device names (Unit 42 lists
aa:bb:cc:dd:ee:ff,DESKTOP-GP01,GP-CLIENT) and for sessions with an empty user domain.
After you patch
- Treat any suspicious VPN session as a domain compromise: reset the
krbtgtaccount twice, rotate privileged and service account passwords, and revoke VPN client certificates. - Check vCenter and ESXi for configuration changes and virtual disk access from the VPN address pool.
Sources
Related identity CVEs
In the Identity Breach Database
Breaches in our database where this vulnerability was exploited.
- k0t access broker breaks into edge devices and harvests directory credentials 2026 · Identity infrastructure vulnerability
- GlobalProtect authentication bypass used as a ransomware front door 2026 · Identity infrastructure vulnerability
Related on Start with Identity
- CVECheck Point Remote Access VPN lets attackers in without a password over IKEv1
A certificate validation logic flaw in Check Point Remote Access and Mobile Access over deprecated IKEv1 let attackers open a VPN session without a valid passwo
- CVEBeyondTrust Remote Support pre-auth command injection, a variant of CVE-2024-12356
An unauthenticated request could run operating system commands on self-hosted BeyondTrust Remote Support and older Privileged Remote Access appliances. Scanning
- Blog39% of identity CVEs are on CISA KEV, and edge appliances hold 62% of the exploited ones
SWI's Identity Vulnerability Report 2026 checked 137 identity CVEs against CISA's Known Exploited Vulnerabilities catalog and NVD. 53 are exploited, most of the
- CVECheck Point Security Gateway information disclosure of password hashes
An unauthenticated read on Check Point Security Gateways leaked password hashes, including those used for VPN and local admin. CISA KEV. May 2024. Hash disclosu
- BlogCISA adds the last two Ivanti Connect Secure chain flaws to KEV after Ivanti's October 29 patch
CISA added Ivanti Connect Secure CVE-2026-111357 and CVE-2026-118527 to its exploited list on October 30, a day after Ivanti patched the root escalation UTA0576
- BlogIvanti Connect Secure auth bypass exploited; CISA gave agencies three days
CVE-2026-104935 lets an unauthenticated attacker bypass Ivanti Connect Secure's login with a crafted header and run commands. Exploited since early October by a