Rapid7 Details Active Exploitation of PAN-OS GlobalProtect Authentication Bypass
Summary
Rapid7 observed exploitation of CVE-2026-0257 across multiple customers, using forged GlobalProtect authentication-override cookies to bypass login on specially configured PAN-OS and Prisma Access systems. No successful lateral movement was observed.
Key points
- CVE-2026-0257 is a medium-severity authentication bypass affecting PAN-OS and Prisma Access when authentication override is enabled and its encryption certificate is reused with another feature.
- Rapid7 MDR observed exploitation across multiple customers, with the earliest activity dated May 17, 2026.
- Rapid7’s analysis found that the appliance trusted decrypted authentication-override cookies without signature verification; an attacker who can obtain the relevant public certificate key can forge cookies.
- Rapid7 observed two waves of activity associated with Vultr and later Dromatics Systems. A reused spoofed MAC address led Rapid7 to assess that the waves were likely from the same actor.
- In 8 of 10 impacted MDR customers, appliances accepted forged-cookie authentication probes without establishing a full VPN session. VPN IP assignment was observed for some customers in the second wave; Rapid7 reported no successful lateral movement.
- Rapid7 recommends urgently installing the vendor patch or, as mitigation, disabling authentication override or using a certificate dedicated to that feature.
Article Details
- Attack Vectors
- Attackers remotely bypassed GlobalProtect authentication by forging authentication override cookies using the public key from a reused TLS certificate.
- The reported exploitation required authentication override to be enabled and its cookie-encryption certificate to be reused with another feature.
- Rapid7 observed two exploitation waves, with source IPs associated with Vultr and Dromatics Systems; VPN IP assignment and internal-network access were observed for some affected customers.
- Defensive Notes
- Urgently apply the vendor-provided updates for affected PAN-OS and Prisma Access versions.
- If patching is not immediately possible, disable authentication override or use a certificate dedicated to that feature.
- Review GlobalProtect authentication logs for suspicious cookie logons, including local admin logons and spoofed MAC addresses.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 104[.]207[.]144[.]154 | Source IP observed by Rapid7 in successful exploitation activity. |
| IPV4 | 146[.]19[.]216[.]119 | Listed by Rapid7 as a threat-actor source IP associated with the exploitation. |
| IPV4 | 146[.]19[.]216[.]120 | Listed by Rapid7 as a threat-actor source IP associated with the exploitation. |
| IPV4 | 146[.]19[.]216[.]125 | Source IP observed by Rapid7 in successful exploitation activity. |
MITRE ATT&CK
T1078 · Valid AccountsThe appliance accepted forged cookies for the local admin account as valid authentication, enabling access.T1134 · Access Token ManipulationRapid7 describes attackers forging and reusing authentication override cookies as bearer-like credentials to bypass normal re-authentication.T1606 · Forge Web CredentialsAttackers forged authentication override cookies using the public key from the TLS certificate reused by the vulnerable configuration.
CVE
Vendors
Palo Alto NetworksRapid7 reported active exploitation of CVE-2026-0257 in Palo Alto Networks PAN-OS and Prisma Access, where attackers used forged GlobalProtect authentication override cookies to bypass login on vulnerable appliances.Rapid7Rapid7 reported active exploitation of CVE-2026-0257 in Palo Alto Networks PAN-OS and Prisma Access, where attackers used forged GlobalProtect authentication override cookies to bypass login on vulnerable appliances.
Products
GlobalProtectRapid7 reported active exploitation of CVE-2026-0257 in Palo Alto Networks PAN-OS and Prisma Access, where attackers used forged GlobalProtect authentication override cookies to bypass login on vulnerable appliances.PAN-OSRapid7 reported active exploitation of CVE-2026-0257 in Palo Alto Networks PAN-OS and Prisma Access, where attackers used forged GlobalProtect authentication override cookies to bypass login on vulnerable appliances.Prisma AccessRapid7 reported active exploitation of CVE-2026-0257 in Palo Alto Networks PAN-OS and Prisma Access, where attackers used forged GlobalProtect authentication override cookies to bypass login on vulnerable appliances.