Palo Alto Networks PAN-OS GlobalProtect Authentication Bypass Vulnerability (CVE-2026-0257)

1. Apply Official Patches

Immediately upgrade your PAN-OS devices to the latest patched maintenance releases recommended by Palo Alto Networks.

2. Temporary Mitigations (Pre-Patch)

If immediate patching is not feasible, implement the following measures:

• Geofencing & IP ACLs: Restrict access to the GlobalProtect portal/gateway to trusted source IP ranges or specific geographic regions.
• Enforce Multi-Factor Authentication (MFA): Integrate robust MFA via external Identity Providers (IdP) to mitigate the impact of primary authentication bypasses.
• Enable Threat Prevention: Ensure that the latest threat prevention signatures are active on your Palo Alto Networks firewalls to detect and block exploitation attempts.

3. Incident Response & Monitoring

Review system and traffic logs for anomalous VPN session establishments or unexpected successful connections from unfamiliar IP addresses.

This vulnerability (CVE-2026-0257) is a critical authentication bypass vulnerability affecting the GlobalProtect portal and gateway components of Palo Alto Networks PAN-OS.

The root cause lies in improper state management, specifically related to cookie/session handling (CWE-565). An unauthenticated remote attacker can exploit this flaw by sending crafted requests to the GlobalProtect interface, allowing them to bypass authentication mechanisms and establish an unauthorized VPN tunnel.

With a CVSS score of 9.1 and its inclusion in the CISA Known Exploited Vulnerabilities (KEV) catalog, this vulnerability represents an immediate threat. The high EPSS score of 0.94 indicates active exploitation in the wild, making rapid remediation a top priority for security teams.