CVE-2026-0257
Palo Alto Networks PAN-OS Authentication Bypass Vulnerability
Description
CVE-2026-0257 is an authentication bypass in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS software that lets an attacker bypass security restrictions and establish an unauthorized VPN connection. The underlying weakness is reliance on cookies without validation and integrity checking, so a client-side value that the portal treats as proof of a completed authentication can be supplied or altered by the attacker instead of being earned. Rated CVSS 9.1 (Critical) with an EPSS score of 94% — the 99.8th percentile of all CVEs — this PAN-OS vulnerability is among the most likely to be exploited that CISA tracks, and the KEV entry records known use in ransomware campaigns, which makes an unauthorized VPN tunnel into a documented ransomware entry route. Panorama and Cloud NGFW are not impacted. CISA's remediation due date was 2026-06-01, so any firewall still running an affected PAN-OS version is past the deadline and exposed to a threat that ends in encryption, not just intrusion.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| paloaltonetworks | pan-os | < 10.2.7; 10.2.7; 10.2.8; 10.2.9; 10.2.10; 10.2.11; 10.2.12; 10.2.13; 10.2.14; 10.2.15; 10.2.16; 10.2.17; 10.2.18; 11.1.0; 11.1.1; 11.1.2; 11.1.3; 11.1.4; 11.1.5; 11.1.6; 11.1.7; 11.1.8; 11.1.9; 11.1.10; 11.1.11; 11.1.12; 11.1.13; 11.1.14; 11.2.0; 11.2.1; 11.2.2; 11.2.3; 11.2.4; 11.2.5; 11.2.6; 11.2.7; 11.2.8; 11.2.9; 11.2.10; 11.2.11; 12.1.2; 12.1.3; 12.1.4; 12.1.5; 12.1.6 |
| paloaltonetworks | prisma access | - |
| siemens | ruggedcom ape1808 firmware | - |
References
- https://security.paloaltonetworks.com/CVE-2026-0257(Vendor Advisory)
- https://cert-portal.siemens.com/productcert/html/ssa-967325.html(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-0257(US Government Resource)
Weakness Type
CWE-565: Reliance on Cookies without Validation and Integrity Checking
Reliance on Cookies without Validation and Integrity Checking occurs when an application depends on the existence, format, or value of a cookie for a security-critical decision without verifying that the value is legitimate and untampered. Cookies live on the client and can be read, modified, or forged with a proxy or a scripted HTTP client, so in the PAN-OS GlobalProtect portal and gateway an attacker who controls the relevant cookie value can present the appearance of an authenticated session and obtain a VPN connection that the authentication logic never actually granted.
Learn more: CWE-565 — Reliance on Cookies without Validation and Integrity Checking
Impact Analysis
CVE-2026-0257 carries a CVSS 3.1 base score of 9.1 (Critical): remotely exploitable without physical access, easy to exploit with no special conditions needed, no authentication needed, and no user action required. Confidentiality (High): an unauthorized VPN connection places the attacker inside the network perimeter with whatever access the tunnel grants, which typically reaches internal file shares, directory services, and management interfaces. Integrity (High): from inside the tunnel the attacker can interact with internal systems directly, and the bypass also undermines the access-control decisions the firewall is supposed to enforce. Availability (None): the flaw itself does not stop the firewall from operating, though what an attacker does after entering certainly can. With an EPSS score of 94%, exploitation activity is effectively certain rather than merely likely, and the KEV ransomware flag confirms the pattern seen repeatedly against VPN gateways: initial access through the appliance, credential harvesting, lateral movement, then encryption. The business impact is therefore not limited to the firewall — it is the whole environment behind it, reached through a channel that security monitoring is inclined to trust because it looks like a legitimate remote-access session.
Exploit Maturity
CVE-2026-0257 sits at the top of every exploitation indicator available: the EPSS score of 93.9% (99.835th percentile) indicates near-certain exploitation activity, CISA lists the CVE in its Known Exploited Vulnerabilities catalog with a due date of 2026-06-01, and the KEV entry marks it as known to be used in ransomware campaigns — an escalation from its earlier record and the reason this vulnerability deserves priority over higher-scoring CVEs without that flag. No public exploit code is linked in the available references; the published sources are the Palo Alto Networks security advisory, the Siemens advisory SSA-967325 for the RUGGEDCOM APE1808 platform, and the CISA KEV entry. Cookie-based authentication bypasses are trivial to reproduce once the mechanism is understood, requiring only an HTTP client rather than exploit tooling, which is consistent with the near-maximum EPSS score. Any affected PAN-OS device with GlobalProtect exposed should be treated as a live incident: patch, then hunt for unauthorized tunnels rather than assuming the patch was applied in time.
Remediation
- Follow the CISA KEV required action: apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. The due date of 2026-06-01 has passed, so remediation is overdue on any affected device.
- Upgrade PAN-OS to a fixed release as listed in the Palo Alto Networks advisory for CVE-2026-0257. Affected versions include PAN-OS before 10.2.7 as well as the 10.2.7 through 10.2.18 maintenance releases, 11.1.0 through 11.1.14, 11.2.0 through 11.2.11, and 12.1.2 through 12.1.6; Prisma Access is also listed as affected, while Panorama and Cloud NGFW are not impacted.
- Where the firewall is a Siemens RUGGEDCOM APE1808 running PAN-OS as a hosted application, follow the additional guidance in Siemens advisory SSA-967325, since patching that platform involves the Siemens update path as well as the PAN-OS release.
- Assume that any internet-facing GlobalProtect portal on an affected version was reachable by attackers and act accordingly: review GlobalProtect authentication and session logs for tunnels established without a matching successful authentication event, check for unfamiliar source addresses and impossible geolocations, audit VPN-assigned IP addresses against internal traffic logs, and rotate credentials for accounts whose sessions cannot be accounted for. Given the ransomware association, verify that backups are offline and restorable before anything else.
- As long-term hardening against CWE-565, never let a client-side cookie carry a security decision on its own: keep session state server-side behind an opaque identifier, protect any cookie-borne data with HMAC or authenticated encryption so tampering is detectable, and validate every cookie value against server-held state. Layer multi-factor authentication in front of GlobalProtect so that a bypass of one gate does not by itself yield network access.
Technical Details
The mechanism of CVE-2026-0257 is that the GlobalProtect portal and gateway in PAN-OS make an authentication decision based on a cookie whose validity and integrity are not verified (CWE-565). Because cookies are stored and transmitted by the client, an attacker using a proxy or a custom HTTP client can set or modify the value that the portal reads, and since the server does not confirm that the value corresponds to genuine server-held session state, the check passes and a VPN connection is established without the attacker ever presenting valid credentials. The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N reflects this precisely: the attack arrives over the network (AV:N) with low complexity (AC:L), no privileges (PR:N), and no user interaction (UI:N), with High impact on confidentiality and integrity and none on availability. Scope remains unchanged (S:U) in CVSS terms because the bypass affects the firewall's own access control, though the practical consequence — a tunnel into the protected network — extends well beyond the appliance. The affected surface spans the PAN-OS 10.2, 11.1, 11.2, and 12.1 trains plus Prisma Access, with Panorama and Cloud NGFW excluded.
Frequently Asked Questions
Is CVE-2026-0257 being actively exploited?
Yes, and it is used in ransomware attacks. CVE-2026-0257 is listed in CISA's Known Exploited Vulnerabilities catalog with a remediation deadline of 2026-06-01, and the KEV entry records known use in ransomware campaigns. Its EPSS score of 93.9% places it in the 99.8th percentile of all CVEs, indicating near-certain ongoing exploitation activity.
What products are affected by CVE-2026-0257?
The vulnerability affects the GlobalProtect portal and gateway in Palo Alto Networks PAN-OS, covering versions before 10.2.7 as well as 10.2.7 through 10.2.18, 11.1.0 through 11.1.14, 11.2.0 through 11.2.11, and 12.1.2 through 12.1.6, plus Prisma Access. Siemens RUGGEDCOM APE1808 firmware is listed as affected because it hosts PAN-OS, while Panorama and Cloud NGFW are not impacted.
How do I fix CVE-2026-0257?
Upgrade PAN-OS to a fixed release listed in the Palo Alto Networks advisory for CVE-2026-0257, and follow Siemens advisory SSA-967325 additionally for RUGGEDCOM APE1808 deployments. Because the flaw yields unauthorized VPN access and is linked to ransomware, also review GlobalProtect session logs for tunnels without matching authentication events, rotate credentials for unexplained sessions, and confirm that offline backups are restorable.
How severe is CVE-2026-0257?
CVE-2026-0257 is rated Critical with a CVSS 3.1 base score of 9.1, reflecting unauthenticated remote exploitation with high impact on confidentiality and integrity. The EPSS score of 93.9% is in the 99.8th percentile and the KEV ransomware flag confirms real extortion campaigns use this bypass, so in practice it should be treated as one of the highest-priority items in any patch queue.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.