Palo Alto Warns of Exploitation of VPN Bypass Exploits (CVE-2026-0257) in PAN-OS Flaw
June 15, 2026 
Palo Alto Networks warns that attackers are actively exploiting CVE-2026-0257, a PAN-OS flaw that lets unauthorized users bypass authentication and establish VPN connections.
Palo Alto Networks has confirmed active exploitation of CVE-2026-0257, a PAN-OS authentication bypass vulnerability affecting GlobalProtect portals and gateways.
Palo Alto Networks addressed the vulnerability on May 13. Two weeks later, cybersecurity firm Rapid7 confirmed active exploitation across multiple customer environments. In early June, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the flaw CVE-2026-0257 to its Known Exploited Vulnerabilities (KEV) catalog.
The flaw affects the GlobalProtect portal and gateway components of Palo Alto Networks PAN-OS, allowing attackers to bypass authentication and establish unauthorized VPN connections. The vulnerabilities do not affect Panorama or Cloud NGFW deployments.
“Authentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS® software allows the attacker to bypass security restrictions and establish an unauthorized VPN connection.” reads the advisory.
If the same certificate is used for both the HTTPS service and the cookie encryption feature, which is a common misconfiguration, an attacker can grab the public key straight from the HTTPS session. Armed with that key, they can craft a cookie for any user, including the local admin account, that the device will accept as legitimate. No credentials required. Rapid7’s Labs team built a proof-of-concept script that demonstrates this in full: retrieve the certificate chain, iterate through each certificate, forge a cookie, test it. The whole attack takes seconds against a vulnerable appliance.
“If we look at the main_DecryptAppAuthCookie function we can begin to see the problem.” reads the report published by Rapid7. “The incoming encrypted cookie is base64 decoded and then decrypted using a private key. The decrypted content is then trusted implicitly, with no signature verification of any kind occurring after decryption.”
Rapid7 MDR caught the first wave of exploitation on May 18 at 01:51 UTC, originating from infrastructure hosted by Vultr. The logs showed cookie-based authentication to the local admin account across several customer environments, using the hostname “GP-CLIENT” on a Linux system and a spoofed MAC address of aa:bb:cc:dd:ee:ff.
A second wave hit on May 21, this time from Dromatics Systems, using the hostname “DESKTOP-GP01” and the same spoofed MAC address. The consistent MAC address across both waves is what led Rapid7 to assess that a single threat actor was behind both campaigns.
“Due to the consistent MAC address, Rapid7 believes both waves of exploitation are likely from the same threat actor. However, the second wave of compromises originated from the hosting provider, Dromatics Systems.” continues the report. “In this wave of exploitation, Rapid7 observed VPN IP assignment following the cookie authentication, granting them access to the internal network.”
In the second wave, some victims did get a VPN IP assignment after the cookie was accepted, meaning the attacker gained access to the internal network.
“Rapid7 MDR identified successful exploitation across numerous customers, however we did not observe any indication of successful lateral movement from the devices.” states Rapid7. “The earliest date for observed exploitation was May 17, 2026”
In 8 out of 10 impacted customers, however, the appliance accepted the forged cookie without establishing a full VPN session. Why it worked completely for some victims and not others remains unclear.
The affected configurations share two traits: Cloud Authentication Service disabled, and authentication override cookies enabled with the cookie certificate shared with the HTTPS service. If your setup doesn’t match that description, you’re not exposed. If it does, patch immediately.
The fix is straightforward: upgrade to a patched PAN-OS version, or as a stopgap, either disable the authentication override feature entirely or generate a dedicated certificate used only for cookie encryption and not shared with any other service. Rapid7 has also published a public proof-of-concept script on GitHub that organizations can use to test whether their appliances are vulnerable before assuming they’re not. Indicators of compromise, including the attacker IP addresses and the two hostnames observed in logs, are published in Rapid7’s advisory.
Palo Alto initially rated this flaw as medium severity because it requires a specific configuration to be exploitable. Rapid7 disagreed from the start. An authentication bypass on an internet-facing enterprise VPN appliance, where a successful exploit lands an attacker directly inside your network, is not a medium-severity problem regardless of what the CVSS calculator says.
“No post-access behavior or lateral movement has been identified as of this time,” reads a reporPalo Alto Networks said. “Only a small portion of the probed devices actually established VPN sessions, resulting in gateway-connected events.”
Palo Alto Networks urges organizations to hunt for the indicators of compromise (IoCs) linked to CVE-2026-0257 exploitation and immediately investigate any successful GlobalProtect VPN connections associated with them. The company recommends activating incident response procedures, reviewing affected systems, applying available mitigations, or upgrading to a patched PAN-OS version.
It also advises checking GlobalProtect logs for successful logins originating from the following IP addresses, particularly for activity observed before the public release of the proof-of-concept exploit on May 29, 2026.
- 23.128.228[.]6
- 104.207.144[.]154
- 146.19.216[.]119
- 146.19.216[.]120
- 146.19.216[.]125
- 179.43.172[.]213
- 185.195.232[.]139
- 198.12.106[.]60
- 202.144.192[.]47
- Host Names and MAC Addresses –
- aa:bb:cc:dd:ee:ff
- 00:11:22:33:44:55
- WINDOWS-LAPTOP-001
- DESKTOP-GP01
- GP-CLIENT
Palo Alto Networks is advising customers to review GlobalProtect logs for any successful gateway connections that match specific indicators tied to a proof-of-concept exploit.
In particular, they should look for sessions where the client configuration shows a Windows 10 Pro 64-bit endpoint and an empty domain field for the source user, as these values may indicate potential exploitation attempts or anomalous connections consistent with the PoC activity.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, CVE-2026-0257)
Stephan is the sports journalist for the Maple Grove Report.
