Palo Alto Networks Unit 42 has confirmed active exploitation of CVE-2026-0257, a critical authentication bypass vulnerability affecting the GlobalProtect portal and gateway components of PAN-OS software.
The flaw allows remote unauthenticated attackers to forge authentication override cookies and establish unauthorized VPN connections without ever providing valid credentials.
The vulnerability was originally assigned a CVSSv4 score of 4.7 (medium), but following confirmed in-the-wild exploitation, Palo Alto Networks revised the score to 7.8 (high) on May 29, 2026, the same day CISA added it to the Known Exploited Vulnerabilities (KEV) catalog.
GlobalProtect VPN Vulnerability Exploited
The root cause lies in PAN-OS’s authentication override feature, which issues encrypted cookies to authenticated GlobalProtect users for seamless re-authentication, functioning similarly to a bearer token.
When the certificate used to encrypt and decrypt these cookies is the same certificate serving the GlobalProtect HTTPS portal or gateway, an attacker can retrieve the public key directly from the TLS handshake and forge a valid authentication cookie without ever authenticating.
Rapid7 Labs confirmed this through a working proof-of-concept (PoC), published on GitHub as forge_cookie.py, which iterates over certificates in the HTTPS chain, forges authentication cookies using each public key, and tests them against the target gateway.
Internally, the main_DecryptAppAuthCookie function in PAN-OS decrypts the incoming cookie but performs no signature verification whatsoever, meaning any correctly encrypted cookie is implicitly trusted and accepted by the appliance.
Rapid7 MDR first observed exploitation on May 17, 2026, with a second wave emerging on May 21, 2026. Both waves involved cookie-based authentication to local admin accounts originating from low-cost hosting providers Vultr and Dromatics Systems.
The consistent spoofed MAC address aa:bb:cc:dd:ee:ff across both waves strongly suggests a single unidentified threat actor behind the campaign.
Unit 42 researchers identified that only a fraction of probed devices established full VPN tunnels roughly 2 out of 10 impacted MDR customers saw complete session establishment, confirmed via POST requests to /ssl-vpn/hipreport.esp and /ssl-vpn/getconfig.esp.
Crucially, no lateral movement has been observed to date, though Palo Alto Networks and continue monitoring for post-access behavior.
The vulnerability impacts several PAN-OS branches, including versions prior to 12.1.4-h6, 11.2.4-h17, 11.1.4-h33, and 10.2.7-h34, as well as Prisma Access versions below 11.2.7-h13 and 10.2.10-h36.
Exploitation is only possible when the authentication override feature is enabled and the override certificate is shared with the HTTPS service a misconfiguration that violates Palo Alto’s own hardening guidance.
Organizations should immediately patch to the vendor-fixed PAN-OS version as outlined in the official security advisory.
As an interim mitigation, administrators should either disable the authentication override feature entirely or generate a dedicated certificate used exclusively for cookie encryption, separate from the HTTPS service certificate.
Indicators of the Activity
| Indicator | Type | Description |
|---|---|---|
| 23.128.228[.]6 | IP Address | Threat actor source IP (pre-PoC) |
| 104.207.144[.]154 | IP Address | Threat actor source IP (pre-PoC); Vultr hosting |
| 146.19.216[.]119 | IP Address | Threat actor source IP (pre-PoC) |
| 146.19.216[.]120 | IP Address | Threat actor source IP (pre-PoC) |
| 146.19.216[.]125 | IP Address | Threat actor source IP (pre-PoC); Dromatics Systems |
| 179.43.172[.]213 | IP Address | Threat actor source IP (pre-PoC) |
| 185.195.232[.]139 | IP Address | Threat actor source IP (pre-PoC) |
| 198.12.106[.]60 | IP Address | Threat actor source IP (pre-PoC) |
| 202.144.192[.]47 | IP Address | Threat actor source IP (pre-PoC) |
| 209.99.191[.]137 | IP Address | Threat actor source IP (Rapid7) |
| 79.130.26[.]202 | IP Address | Threat actor source IP (Rapid7) |
| aa:bb:cc:dd:ee:ff | MAC Address | Spoofed MAC address; observed in both exploitation waves |
| 00:11:22:33:44:55 | MAC Address | Spoofed MAC address |
| WINDOWS-LAPTOP-001 | Hostname | Suspicious host ID in GlobalProtect logs |
| DESKTOP-GP01 | Hostname | Observed in logs alongside Windows authentications from May 21, 2026 |
| GP-CLIENT | Hostname | Observed in logs alongside Linux authentications from May 17, 2026 |
| Jocker | Hostname | Observed alongside IP 79.130.26[.]202 |
| Microsoft Windows 10 Pro 64-bit | OS String | Hard-coded PoC client OS value in post-PoC exploitation |
| (empty) | Domain Field | Hard-coded empty domain value in PoC client configuration |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
