CVE-2026-0257: PAN-OS GlobalProtect authentication bypass via unvalidated cookies

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityIt is in CISA KEV with known ransomware use, has a near-maximum EPSS score, and allows unauthenticated network attackers to establish a VPN foothold.

What it is

PAN-OS GlobalProtect portal and gateway contain authentication bypass flaws that let an attacker skip security restrictions and establish an unauthorized VPN connection. The weakness is classified as reliance on cookies without validation (CWE-565), meaning a crafted or replayed cookie can be trusted without proper verification. Panorama and Cloud NGFW are not affected.

Impact

An attacker gains an unauthorized VPN session into the protected network, effectively bypassing the authentication boundary. The CVSS 4.0 vector shows low confidentiality impact on the vulnerable system but high subsequent confidentiality and integrity impact, so the real risk is lateral access to internal resources.

Attack surface

Reachable over the network through the GlobalProtect portal and gateway interfaces; the vector indicates no privileges and no user interaction required. No authentication is needed because the flaw itself is the authentication bypass.

Exploitation

Listed in CISA KEV with a due date of 2026-06-01 and flagged for known ransomware campaign use, and EPSS is 0.95156 (99.861st percentile), indicating active exploitation is expected or observed. The vendor and Siemens advisories confirm the issue but do not add exploit detail.

What to do

• Apply the Palo Alto Networks PAN-OS updates referenced in the vendor advisory security.paloaltonetworks.com/CVE-2026-0257 as the first action.
• If patching cannot be completed by the CISA due date, apply the vendor's documented mitigations or restrict GlobalProtect portal and gateway exposure per BOD 22-01 guidance.
• Review Siemens SSA-967325 for any Ruggedcom APE1808 firmware guidance if that product is in scope.
• Audit GlobalProtect authentication and session logs for unexpected VPN sessions and terminate any that cannot be tied to a legitimate user.
• Consider disabling or tightly restricting GlobalProtect portal and gateway access from untrusted networks until patched.

Detection

• Hunt GlobalProtect authentication logs for successful VPN sessions with missing, malformed or replayed cookie attributes, or sessions that do not map to a completed authentication event.
• Alert on new VPN sessions from unusual geographies, ASNs or IPs that have no prior authentication history.
• Correlate GlobalProtect session creation with identity provider logs; flag sessions with no matching IdP authentication.
• Monitor for post-connection lateral movement or internal scanning originating from VPN-assigned addresses.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.