Palo Alto Networks PAN-OS Authentication Vulnerability Bypass Exploited in the Wild
\n \t
\n
<\/BR>
\n
\n \t
\n
<\/BR><\/p>\n
Palo Alto Networks authentication bypass vulnerability, CVE-2026-0257, affecting PAN-OS and Prisma Access, is now being actively exploited in the wild, with CISA adding it to the Known Exploited Vulnerabilities (KEV) catalog on May 29, 2026.<\/p>\n
Palo Alto Networks published its security advisory on May 13, 2026, warning that CVE-2026-0257 enables a remote unauthenticated attacker to forge authentication override cookies and establish unauthorized VPN connections<\/a> through the GlobalProtect gateway.<\/p>\n The vulnerability exists in a non-default feature called \u201cauthentication override,\u201d which allows GlobalProtect portals and gateways to issue session cookies to authenticated users similar to a bearer token, so users don\u2019t need to re-authenticate each session.<\/p>\n The flaw is triggered only when the certificate used to encrypt and decrypt these authentication override cookies is shared with another feature, such as the HTTPS service of the portal or gateway.<\/p>\n Because the decryption process in the Rapid7 has identified the earliest exploitation<\/a> on May 17, 2026, with a first wave of attacks originating from IPs hosted on Vultr. On May 18, Rapid7 detected suspicious cookie-based authentication to local admin accounts across multiple customer environments.<\/p>\n The attacker used the machine name A second exploitation wave occurred on May 21, 2026, this time originating from the hosting provider Dromatics Systems, using machine name In this wave, some victims had full VPN IP assignments granted after the cookie authentication, giving attackers direct access to internal networks. Across both waves, the consistent spoofed MAC address suggests a single threat actor behind both campaigns. Notably, 8 out of 10 impacted MDR customers saw only authentication probes, not full VPN session establishment.<\/p>\n\/usr\/local\/bin\/gpsvc<\/code> binary performs no signature verification after decrypting the cookie, any attacker who can retrieve the public key from the exposed HTTPS certificate can forge a valid authentication cookie and bypass authentication entirely.<\/p>\nGP-CLIENT<\/code> and a spoofed MAC address (aa:bb:cc:dd:ee:ff<\/code>) to masquerade as a legitimate endpoint.<\/p>\nDESKTOP-GP01<\/code>.<\/p>\nIndicators of Compromise<\/strong><\/h2>\n