Share
## https://sploitus.com/exploit?id=2C789584-82FD-5503-B3B1-B5B9573BD5DA
# ๐จ CVE-2026-0257 โ PAN-OS GlobalProtect Authentication Bypass
> Security research, technical analysis, detection guidance, IOC collection, and defensive validation resources for CVE-2026-0257.
---
## ๐ Overview
CVE-2026-0257 is an authentication bypass vulnerability affecting Palo Alto Networks GlobalProtect Portal and Gateway deployments running vulnerable PAN-OS versions under specific configurations.
The vulnerability stems from improper trust of Authentication Override cookies, allowing attackers to bypass authentication mechanisms and establish unauthorized VPN connections when exposed configurations are present.
**Vendor Severity:** HIGH
**CVSS v4:** 7.8
**Exploitation Status:** Actively Exploited in the Wild
**CISA KEV:** Added
---
## โก Impact
An attacker may be able to:
* Bypass authentication controls
* Establish unauthorized VPN sessions
* Access internal network resources
* Impersonate legitimate users
* Launch post-authentication attacks against enterprise environments
---
## ๐ฏ Vulnerability Conditions
A target is generally exposed when:
* GlobalProtect Portal or Gateway is enabled
* Authentication Override is enabled
* Authentication Override cookies are accepted
* Certificate reuse exposes the cookie encryption public key
### Typical Attack Flow
```text
Attacker
โ
โผ
Obtain Public Key
โ
โผ
Forge Authentication Cookie
โ
โผ
Submit Cookie to GlobalProtect
โ
โผ
Authentication Bypass
โ
โผ
Unauthorized VPN Access
```
---
## ๐ Technical Summary
Research indicates that Authentication Override cookies are decrypted and trusted without sufficient integrity validation.
When the same certificate is reused for both:
* HTTPS Service
* Authentication Override Cookie Encryption
an attacker may be able to obtain the corresponding public key and generate forged cookies accepted by vulnerable systems.
---
## ๐ก Affected Products
| Product | Affected Versions |
| ------------------ | --------------------------------------- |
| PAN-OS 10.2 | Multiple versions prior to vendor fixes |
| PAN-OS 11.1 | Multiple versions prior to vendor fixes |
| PAN-OS 11.2 | Multiple versions prior to vendor fixes |
| PAN-OS 12.1 | Multiple versions prior to vendor fixes |
| Prisma Access 10.2 | Vulnerable releases |
| Prisma Access 11.2 | Vulnerable releases |
Refer to the official Palo Alto Networks advisory for exact version information.
---
## ๐ฅ Known Exploitation
Rapid7 observed active exploitation beginning in May 2026.
Observed attacker activity included:
* Suspicious cookie-based VPN authentications
* Authentication bypass attempts
* Unauthorized VPN tunnel establishment
* Repeated exploitation from cloud-hosted infrastructure
---
## ๐ฉ Indicators of Compromise (IOCs)
### Source IP Addresses
```text
104.207.144.154
146.19.216.119
146.19.216.120
146.19.216.125
209.99.191.137
79.130.26.202
```
### Observed Hostnames
```text
GP-CLIENT
DESKTOP-GP01
Jocker
```
### Observed MAC Address
```text
aa:bb:cc:dd:ee:ff
```
---
## ๐ Detection Opportunities
Monitor for:
* Cookie-based GlobalProtect logins
* Unexpected VPN authentications
* VPN sessions without corresponding MFA events
* Connections from unfamiliar IP ranges
* Authentication attempts using generic hostnames
* Suspicious activity following VPN establishment
---
## ๐ Mitigation
### Immediate Actions
* Upgrade PAN-OS to a fixed version.
* Disable Authentication Override where possible.
* Deploy a dedicated certificate exclusively for Authentication Override cookies.
* Review GlobalProtect authentication logs.
* Hunt for IOC matches within VPN logs.
### Recommended Priority
| Environment | Priority |
| --------------------------------------------- | --------------- |
| Internet-facing GlobalProtect + Auth Override | ๐ด Critical |
| Internet-facing GlobalProtect | ๐ High |
| Internal-only Deployments | ๐ก Medium |
| Panorama / Cloud NGFW | ๐ข Not Affected |
---
## ๐ References
* Palo Alto Networks Security Advisory
* Rapid7 Technical Analysis
* CISA Known Exploited Vulnerabilities Catalog
* MITRE CVE Database
---
## โ Disclaimer
This repository is intended solely for:
* Security Research
* Defensive Validation
* Threat Hunting
* Detection Engineering
* Educational Purposes
The authors do not encourage, support, or condone unauthorized access to any system. Users are solely responsible for ensuring that all testing is performed with proper authorization and in compliance with applicable laws and organizational policies.
---
## โญ Support
If this research helps your team:
๐ Star the repository
๐ Share with defenders
๐ก Help organizations patch vulnerable systems
---
**[Maintained by GrayXploit Security Research Team](https://grayxploit.com/)**