Skip to content
All posts

· by NetProtector Security Team

Palo Alto: GlobalProtect Flaw Opens the VPN Without Authentication

Illustration: A key is extracted from the certificate, and a forged cookie opens the VPN gate

VPN access without a password, without MFA and without a valid account: this is what a vulnerability in the GlobalProtect portal and gateway from Palo Alto Networks makes possible. The vendor disclosed the flaw CVE-2026-0257 on May 13, 2026. Since May 29, it has been clear that it is being actively exploited. The US agency CISA added it to its catalog of known exploited vulnerabilities on the same day. Only certain configurations are affected, but if you use one of them, you should act now.

What it is about

So that users do not have to sign in again for every VPN connection, GlobalProtect can issue a cookie for "Authentication Override" after a successful login. The client later uses this cookie to authenticate without prompting for credentials again. The cookie is encrypted with a certificate. If this is the same certificate that the portal or gateway also uses to secure its HTTPS connections, anyone can read the public key from the TLS connection. Because PAN-OS accepted the decrypted cookie content without verifying a signature, this makes it possible to forge cookies for any user.

Key facts according to the Palo Alto advisory:

  • Severity: high, CVSS 7.8. Palo Alto initially rated the flaw as medium and raised the rating on May 29, when attacks became known.
  • Affected: PAN-OS 10.2, 11.1, 11.2 and 12.1 as well as Prisma Access, provided that authentication override cookies are enabled on the GlobalProtect portal or gateway and a specific certificate configuration is in place. Cloud NGFW and Panorama are not affected.
  • Fixed in: hotfixes for all four version branches, such as 12.1.7, 11.2.12, 11.1.15 or 10.2.18-h6 and later. For other maintenance releases within the branches, the advisory lists separate hotfix versions. Palo Alto updates Prisma Access itself.
  • Attack prerequisites: no credentials and no user interaction, only network access to a portal or gateway with the affected configuration.
  • Impact: a VPN session in the name of any account, i.e. access to the internal network.
  • Workaround: a new certificate used exclusively for the override cookies, or disabling Authentication Override entirely.

The flaw was discovered by Palo Alto's own security team. The advisory included a workaround from the outset.

Why this is urgent

The attacks started early. Security company Rapid7 observed the first exploitation as early as May 17, four days after the advisory, at several customers. The forged cookies targeted the local admin account, and the logins came from servers at hosting providers. In many cases, the device accepted the cookie without a full VPN session being established. In a second wave starting May 21, however, the attackers gained access to internal networks.

In early June, Arctic Wolf reported an increase in attacks. After the VPN session was established, the company in some cases also observed lateral movement within the internal network. Because such a session looks like normal VPN access, it often only stands out due to unusual source addresses.

This is not the first time GlobalProtect portals have been targeted. In April 2024, CVE-2024-3400 (CVSS 10) was attacked before a patch was available. In March 2025, GreyNoise counted login scans against GlobalProtect portals from around 24,000 IP addresses. And in early May 2026, Palo Alto closed CVE-2026-0300, a critical, already exploited flaw in the User-ID authentication portal.

This is not a problem of a single vendor. VPN gateways from all major vendors are attacked again and again. They are reachable from the internet and lead directly into the corporate network. As soon as an advisory is published, a race between attackers and administrators begins.

What you should do now

  1. Check the configuration. In the portal under Agent › Agent Configuration › Authentication ("Generate cookie …" or "Accept cookie for authentication override"), in the gateway under Agent › Client Settings › Authentication Override. If none of these options is enabled, the device is not affected according to the advisory.
  2. Update. Install the hotfix for your version branch. All portals and gateways that generate or accept cookies should be updated together; otherwise the cookies will no longer match.
  3. Apply the workaround in the meantime. Generate a new certificate used only for the override cookies. According to Palo Alto, a certificate that was previously used for other services is not suitable, even if it has since been removed there. Alternatively, disable the feature.
  4. Review the logs. Search the GlobalProtect logs for cookie-based logins, especially to the local admin account and from hosting networks. Where possible, restrict portal access to known IP ranges.
  5. If you suspect a compromise, terminate the sessions, reset affected accounts and check what was accessed from the VPN session.

What this means for protecting firewalls

CVE-2026-0257 shows a familiar pattern from a different angle: it is not a spectacular memory corruption bug that opens the door, but a convenience feature combined with a certificate setting. Four days passed between the advisory and the first attacks. During this time, the VPN portal has to remain reachable; otherwise no one can work remotely.

NetProtector steps in one stage earlier. The appliance is deployed inline as a bridge between router and firewall and sees the traffic before the GlobalProtect portal processes it:

  • Known attackers do not reach the portal. Scans and login attempts against VPN portals often originate from servers that also stand out elsewhere. Sources that the NetProtector sensor network has already observed as attackers are dropped before the firewall.
  • Preparation becomes visible. Mass scans for specific device types or high-frequency login attempts are traffic anomalies that NetProtector detects and reports.
  • Time until the patch. NetProtector replaces neither the update nor the review of your own configuration. It does, however, reduce how many attackers reach the portal at all, especially in the days when a vulnerability is known but not yet closed everywhere.
Installed as a bridge
Traditional setup
Internet
Router
Firewall
Company network
With NetProtector
Internet
Router
NetProtector
Firewall
Company network
Works as a bridge directly in the traffic flow between router and firewall.
Filters unwanted traffic before it reaches the firewall – including its VPN gateways.
Installed in minutes, protecting from the moment it goes live.

How NetProtector is integrated between router and firewall and what this means for ongoing operations is described on our Integration and Operation page.

Our assessment

Palo Alto got a lot right here: the flaw was found internally, the advisory immediately included a workaround, and the rating was raised as soon as attacks became known. Attacks still occurred, because time passes between disclosure and update. For systems at the network edge, the severity rating alone should therefore not be decisive, but rather what an attacker could achieve in the worst case. Convenience features such as override cookies should be reviewed regularly. And as with every vendor: VPN access needs multiple layers of protection – prompt updates, a lean configuration, monitored logins and a layer in front of the firewall that intercepts attackers before they reach the portal.

Sources