PAN-OS CVE-2026-0257: GlobalProtect Authentication Bypass and Patch Guide

Introduction

Short answer:** CVE-2026-0257 is a high-severity PAN-OS authentication-bypass vulnerability affecting certain GlobalProtect portal and gateway configurations. Palo Alto Networks says limited exploit attempts have been observed, while Unit 42 reports active exploitation and ransomware-operator activity. The defensive response is to identify exposed PAN-OS versions and authentication-override settings, apply the vendor’s fixed release, review GlobalProtect logs, and verify that every relevant portal and gateway is remediated. [1] [2]

**Key Takeaways**

- CVE-2026-0257 can allow an unauthenticated attacker to bypass security controls and establish an unauthorised VPN connection through vulnerable GlobalProtect components.

- The vendor marks the issue as **ATTACKED** and recommends the highest response urgency; this is a patch-priority issue, not a reason to test an internet-facing firewall with exploit code.

- Exposure depends on the PAN-OS branch, patch level, GlobalProtect configuration and authentication-override cookie settings.

- After patching, administrators should re-authenticate users as needed, check gateway-connected events, and confirm that the live portal and gateway are running a fixed build.

What is PAN-OS CVE-2026-0257?

CVE-2026-0257 is an authentication-bypass vulnerability in the GlobalProtect portal and gateway components of Palo Alto Networks PAN-OS. Palo Alto Networks describes a network-reachable flaw that can let an attacker bypass security restrictions and establish an unauthorised VPN connection. The advisory rates it HIGH with a CVSS v4 score of 7.8 and labels the exploit maturity **ATTACKED**. [1]

The issue is not the same as a normal password-guessing incident. An attacker may be able to reach the authentication-override path without valid credentials when the affected conditions are present. That means a strong password policy or multi-factor authentication control should not be treated as proof that an unpatched, exposed GlobalProtect service is safe.

Palo Alto Networks says Panorama and Cloud NGFW are not impacted by this issue. Teams should still verify the exact product, PAN-OS branch and deployment model rather than assuming that every Palo Alto environment has identical exposure. [1]

Why is this vulnerability urgent?

The vendor says it has become aware of limited exploit attempts against unpatched PAN-OS devices without mitigations. Unit 42 separately reports attempted exploitation and says ransomware operators, including groups tracked as Spikey Scorpius and Tarnished Scorpius, have targeted the flaw. Unit 42 also describes successful sessions followed in some cases by internal reconnaissance, lateral movement and ransomware-related activity. [2]

That reporting does not mean every vulnerable firewall has been compromised. It does mean that defenders should move CVE-2026-0257 into an urgent vulnerability-management queue. A safe priority order is: identify internet-facing GlobalProtect systems, confirm versions and configuration, patch through the supported vendor path, preserve relevant logs, and investigate successful gateway-connected events that cannot be explained by legitimate users.

Google Trends for India showed a sharp but brief relative-interest spike for the exact CVE query during the seven-day window reviewed on 22 October 2026. Google Trends is a normalized interest signal, not search volume, confirmed demand, or a traffic forecast. The spike supports timely reader interest but does not justify sensational claims about Indian organisations being compromised.

Who may be exposed?

The affected product is PAN-OS with GlobalProtect portal or gateway functionality. The configuration details matter. Palo Alto Networks says the issue affects firewalls where authentication-override cookies are enabled and a specific certificate configuration is present. Administrators should review both external and internal GlobalProtect portals and gateways that generate or accept these cookies. [1]

The version check must cover every active firewall and every relevant component. A device can have more than one PAN-OS branch in an organisation, and a phased upgrade can leave a second portal or gateway behind. A central inventory should record the hostname, role, PAN-OS version, GlobalProtect configuration, certificate used for authentication override, maintenance owner and verification time.

A public management interface also increases risk. Unit 42 describes cases where management interfaces were unintentionally exposed through HTTP or HTTPS services, including ports 4443 and 3879. This is a configuration exposure that should be assessed through approved administrative procedures, not by probing systems you do not own. [2]

Which PAN-OS versions are fixed?

Palo Alto Networks lists several fixed-version thresholds. The exact upgrade path depends on the branch:

Do not copy a version number from a blog post into a change ticket without checking the current Palo Alto Networks advisory. The vendor’s product-status table is the authoritative reference for the installed branch and supported upgrade path. Unsupported PAN-OS branches require a supported migration or vendor-provided remediation plan.

• PAN-OS 12.1: 12.1.4-h6 or later, or 12.1.7 or later, according to the affected-version path.
• PAN-OS 11.2: 11.2.4-h17, 11.2.7-h14, 11.2.10-h7 or 11.2.12 and later, depending on the installed minor release.
• PAN-OS 11.1: 11.1.4-h33, 11.1.6-h32, 11.1.7-h6, 11.1.10-h25, 11.1.13-h5 or 11.1.15 and later, depending on the installed branch.
• PAN-OS 10.2: 10.2.7-h34, 10.2.10-h36, 10.2.13-h21, 10.2.16-h7 or 10.2.18-h6 and later, depending on the installed release.
• Prisma Access customers should follow the separate fixed-version guidance in the vendor advisory.

How should administrators check exposure safely?

Start with an inventory and approved management access. Avoid publishing a temporary `phpinfo`-style diagnostic page or exposing firewall version details through an unauthenticated response. For each GlobalProtect portal and gateway, record the PAN-OS version, whether authentication-override cookies are generated or accepted, the certificate assignment, and whether the interface is reachable from the public internet.

Next, review the vendor’s configuration requirements. Palo Alto Networks identifies the portal and gateway menus where administrators can check authentication override. If the feature is not required, disabling authentication override can reduce risk. If it is required, use a dedicated certificate for authentication-override cookies rather than reusing a certificate assigned to another function. [1]

Finally, review logs around suspicious activity. Unit 42 recommends searching GlobalProtect logs for successful gateway-connected events and for unusual host identifiers or device names. Preserve the relevant log window before rotating, deleting or overwriting records. Log review is an investigation aid; it is not a substitute for patching.

What is the safest patching sequence?

### 1. Confirm the supported change path

Use the Palo Alto Networks support portal, the approved software channel, or the organisation’s controlled upgrade process. Confirm the target version, device role, configuration backup and rollback plan before starting. Do not download firmware from an unverified link or rely on an unofficial workaround.

### 2. Patch every relevant GlobalProtect component

Upgrade all portals and gateways that generate or accept the affected authentication-override cookies. Palo Alto Networks warns that all relevant on-premises components should be upgraded in accordance with the fixed-version guidance so that cookie compatibility is not broken between mixed versions. [1]

### 3. Re-authenticate users when required

The vendor says users may need to authenticate again after the upgrade because the authentication-override cookie is regenerated using a more secure method. Schedule the change with the service owner and communicate the expected sign-in behavior before the maintenance window.

### 4. Verify the live service

After the upgrade, confirm the active PAN-OS build, GlobalProtect portal and gateway status, authentication flow, certificate assignment and normal user connectivity. Test with approved accounts and normal operational checks. Do not use exploit payloads against production equipment.

### 5. Investigate unexplained successful sessions

Search for successful gateway-connected events that do not match expected users, devices or change windows. If there are signs of compromise, preserve evidence and follow the organisation’s incident-response plan. Patch completion alone does not establish that an earlier intrusion did not occur.

Can a workaround replace the update?

A workaround can reduce exposure while a supported upgrade is being scheduled, but it is not the complete fix. Palo Alto Networks recommends either disabling authentication override or using a dedicated certificate for authentication-override cookies. These controls should be applied through the normal change process and verified on every relevant portal and gateway. [1]

Do not confuse a mitigation with remediation. A firewall can remain on a vulnerable PAN-OS build even after one configuration change. Treat the workaround as temporary risk reduction, keep the upgrade ticket open, and document the exact devices and settings covered.

What should Indian organisations prioritise?

Indian organisations should begin with public-facing GlobalProtect services that protect customer data, payment systems, identity services, remote administration or essential business operations. Include subsidiaries, disaster-recovery sites, managed security providers and cloud-connected branches in the inventory. A small organisation can start with a dated spreadsheet containing hostname, device owner, PAN-OS version, GlobalProtect role, patch status and verification evidence.

CERT-In’s vulnerability-note and advisory channels are useful sources for India-facing security updates. They do not replace the product vendor’s technical advisory. Organisations should check their own contractual, regulatory and incident-reporting requirements rather than infer a reporting obligation from a news report. Preserve logs and escalate suspected compromise through the approved response process.

Frequently asked questions

### Does CVE-2026-0257 bypass MFA?

The reported issue affects authentication controls in the GlobalProtect authentication-override path. Because the exact exposure depends on configuration and version, organisations should not assume that MFA alone protects an unpatched device. Follow the vendor’s fixed-version and mitigation guidance.

### Is every Palo Alto firewall affected?

No. The advisory identifies affected PAN-OS branches and configuration conditions. Panorama and Cloud NGFW are listed as not impacted. Check each device and deployment model against the current Palo Alto Networks advisory.

### Should I disable GlobalProtect immediately?

Not as a blanket action without understanding business impact. First use the approved administrative path to identify affected devices and authentication-override settings. If an emergency response requires disabling a feature or restricting access, coordinate the change with the service owner and preserve logs.

### Does a Trends spike prove widespread attacks in India?

No. Google Trends reports normalized relative interest and does not reveal confirmed incidents, exact search volume or geographic attribution of a compromise. The India signal is useful for deciding that readers may need a timely explainer, not for claiming that Indian organisations were attacked.

Conclusion

CVE-2026-0257 should be handled as an urgent PAN-OS and GlobalProtect patching issue. The practical response is to inventory every portal and gateway, check the affected PAN-OS branch and authentication-override configuration, apply a supported fixed release, re-authenticate users where required, review logs and verify the live service. Temporary mitigations may reduce risk, but they do not replace a supported update or an investigation when suspicious sessions are found.

Internal reading

• [Understanding zero-day vulnerabilities](/articles/understanding-zero-day-vulnerabilities)
• [Incident response first hour](/articles/incident-response-first-hour)
• [Basic network security concepts](/articles/basic-network-security-concepts)
• [Cybersecurity vs. information security](/articles/cybersecurity-vs-information-security)

Decision checklist

• PAN-OS 12.1: 12.1.4-h6 or later, or 12.1.7 or later, according to the affected-version path.
• PAN-OS 11.2: 11.2.4-h17, 11.2.7-h14, 11.2.10-h7 or 11.2.12 and later, depending on the installed minor release.
• PAN-OS 11.1: 11.1.4-h33, 11.1.6-h32, 11.1.7-h6, 11.1.10-h25, 11.1.13-h5 or 11.1.15 and later, depending on the installed branch.
• PAN-OS 10.2: 10.2.7-h34, 10.2.10-h36, 10.2.13-h21, 10.2.16-h7 or 10.2.18-h6 and later, depending on the installed release.
• Prisma Access customers should follow the separate fixed-version guidance in the vendor advisory.
• [Understanding zero-day vulnerabilities](/articles/understanding-zero-day-vulnerabilities)
• [Incident response first hour](/articles/incident-response-first-hour)
• [Basic network security concepts](/articles/basic-network-security-concepts)
• [Cybersecurity vs. information security](/articles/cybersecurity-vs-information-security)

Limitations

• Reporting channels, procedures and security guidance can change; verify current instructions before acting.

Evidence sources

1. security.paloaltonetworks.com — Palo Alto Networks Security Advisory CVE-2026-0257
2. unit42.paloaltonetworks.com — Unit 42 Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257
3. cisa.gov — CISA Known Exploited Vulnerabilities Catalog
4. cert-in.org.in — CERT-In Vulnerability Notes