Palo Alto’s GlobalProtect VPN Hit by Active Exploits—Here’s How to Secure Your Windows PCs and Servers

Palo Alto Networks has patched a critical authentication bypass vulnerability in its GlobalProtect VPN after confirming that attackers are actively trying to break into unpatched devices. The flaw, tracked as CVE-2026-0257, allows an unauthorized person to slip past the VPN login and gain access to corporate networks, putting Windows file shares, remote desktops, and internal applications at risk. The company updated its advisory on May 29 to warn that exploitation attempts have been seen in the wild, urging administrators to upgrade affected PAN-OS appliances immediately or apply emergency workarounds.

The flaw: a stolen cookie lets attackers walk in

At the heart of CVE-2026-0257 is a trust problem with authentication override cookies—a convenience feature that lets you stay logged into GlobalProtect without retyping your password. When that feature is turned on alongside a particular certificate configuration, an attacker can forge a valid cookie and connect to the VPN as though they are a legitimate user.

The vulnerability sits in both the GlobalProtect portal (the web-based entry point) and the gateway (the actual tunnel endpoint). It doesn’t matter if you use two-factor authentication, strong passwords, or client certificates for normal login—the forged cookie bypasses all of that. Palo Alto rates it 7.8 out of 10 on the CVSS v4.0 scale (HIGH severity) and marks the urgency as HIGHEST because attackers are already probing for vulnerable devices.

Affected PAN-OS branches and their fixed versions:

Prisma Access cloud firewalls are being upgraded automatically by Palo Alto, and Cloud NGFW appliances are not affected. Panorama management systems are also out of scope. If you run an on‑premises firewall with GlobalProtect enabled, it’s your responsibility to act.

After patching, the appliance regenerates authentication cookies using a tougher method—so every user will have to sign in again at least once, even if they had a valid cookie before the upgrade. That’s a one‑time event and doesn’t signal anything wrong.

Who’s at risk? Not everyone, but double‑check your setup

The vulnerability is not universal. It only bites if all of these conditions are true:

• A GlobalProtect portal or gateway is configured on the firewall.
• Authentication override cookies are enabled (the “Generate cookie for authentication override” or “Accept cookie for authentication override” checkbox is ticked in the portal/gateway agent settings).
• A certificate is used in the authentication override process, and it’s configured in a way that allows the bypass.

If you’ve never touched the authentication override feature, or if you use the VPN only with standard login prompts, your immediate exposure may be much lower. However, many organizations turned on that feature to reduce friction for remote users, often without documenting the change. That’s why Palo Alto urges every admin to verify—assumptions here are dangerous.

For Windows home users and remote workers, the practical impact is small: after your IT department patches the gateway, you’ll be asked to re‑enter your password once. There’s no action you need to take on your own device, but do report any sudden or odd VPN login requests that appear when you haven’t tried to connect.

For IT administrators, the stakes are much higher. An attacker who establishes an unauthorized VPN session gets the same network foothold as any remote employee. From there, they can scan for open Windows file shares, probe Remote Desktop Protocol (RDP) ports, attempt lateral movement toward domain controllers, and reach internal web applications that were never designed to face the internet. The fact that the VPN was previously considered a trusted boundary makes that foothold exceptionally valuable.

This is why patching alone is not enough. If your firewall matched the exposure conditions before the fix, you must also hunt for signs of abuse—not only to confirm the upgrade worked, but to ensure nobody already slipped through the door.

A timeline of escalation: from advisory to attacks

Palo Alto published the initial security advisory and fixed PAN‑OS releases on May 13, 2026. The advisory described the authentication bypass in technical terms and offered workarounds, but at that time the company had not seen exploitation attempts.

On May 29, the advisory got an urgent update: “Palo Alto Networks has become aware of limited exploit attempts on unpatched PAN‑OS devices without mitigations applied.” The CVSS Threat Score rose accordingly, reflecting the real‑world attacks. External researchers at Rapid7 also independently reported observing exploitation activity around the same window, confirming that attackers were scanning for vulnerable GlobalProtect endpoints.

The timeline is uncomfortably short—16 days from disclosure to observed attacks—and it highlights a pattern that has played out with other VPN appliances in recent years. Once a vulnerability becomes public, internet‑facing access gateways are scanned relentlessly. Attackers know that patching takes time, especially in large organizations with maintenance windows and change‑control processes.

What to do now: patch, hunt, and harden

If you manage a PAN‑OS firewall that runs GlobalProtect, treat this as a top‑priority security event. Here’s a concrete action plan:

1. Identify whether you’re exposed

• List every PAN‑OS appliance in your inventory and note its current version.
• For each appliance, log onto the management interface and check both the GlobalProtect portal and gateway settings:
• Navigate to Network → GlobalProtect → Portals (or Gateways), click your profile, go to the Agent tab, then the Authentication tab.
• See if “Generate cookie for authentication override” or “Accept cookie for authentication override” is checked.
• If the checkbox is on, review which certificate is being used for the override. Palo Alto advises that if the certificate is shared with other services or was previously used for something else, your exposure is higher.

2. Patch or mitigate immediately

• Patch: Upgrade to the fixed version for your branch (see table above). If your release is not directly in a vulnerable range, check the detailed upgrade paths in the advisory—some older 10.2.x and 11.x sub‑versions require intermediate hops.
• Mitigate: If you can’t patch right now, take one of these actions to close the hole:
• Disable authentication override: Uncheck both cookie options in the portal and gateway profiles. That stops the feature cold, though users will have to authenticate manually every time.
• Use a dedicated certificate: Generate a brand‑new certificate pair, assign it exclusively to authentication override cookies, and do not reuse it for any other purpose (not even the normal portal/gateway SSL certificate).

Be aware that after patching, all GlobalProtect users will be prompted to re‑authenticate once. Plan a communication to your workforce so they don’t mistake the prompt for a phishing attempt or an outage.

3. Hunt for signs of prior access

Even if you patch quickly, assume an attacker could have been inside before the fix. Review VPN logs for:
- Unusual connection timestamps (outside business hours).
- Source IP geolocations you don’t recognize.
- User accounts connecting from two different regions simultaneously.
- Sessions that bypass normal two‑factor prompts (some log patterns may show direct cookie usage).
- Internal destination IPs accessed immediately after VPN connect—especially management interfaces, file servers, or domain controllers.

Palo Alto hasn’t released a generic indicator-of-compromise list, but the Unit42 threat brief (linked below) may offer more specific forensic markers. Don’t rely solely on known signatures; look for anomalies.

4. Re‑assess what the VPN grants

A VPN connection should never be the only thing standing between an outsider and your most sensitive Windows assets. Use this incident as a reason to:
- Segment your internal network. Limit what VPN users can reach based on their role, device posture, or group membership.
- Enforce authentication at the application layer. Even if a user is “on the VPN,” require Kerberos or Entra ID auth for file shares, RDP, and intranet sites.
- Apply the principle of least privilege to VPN subnets. Default‑allow rules for VPN address ranges are a recipe for disaster.

For phased upgrades: a temporary compatibility toggle

If you must upgrade some firewalls before others and want to keep authentication cookies working across the mixed environment, Palo Alto provides a CLI command to temporarily relax the new cookie validation:

# set global-protect enable-auth-override-cookie-hmac no

This reverts to the old cookie behaviour so that unpatched and patched appliances can coexist. Do not forget to run the counterpart once all devices are patched:

# set global-protect enable-auth-override-cookie-hmac yes

Leaving the old setting active permanently negates much of the security improvement.

The bigger lesson: VPNs aren’t magic trust machines

CVE-2026-0257 isn’t an isolated incident; it’s the latest in a long line of vulnerabilities that abuse the trust we place in VPNs. When a single cookie or certificate can grant an attacker the same access as a legitimate employee, the entire concept of a “secure perimeter” becomes shaky.

For Windows administrators, that means revisiting old assumptions. Your file servers, domain controllers, backup systems, and intranet apps should challenge every request, regardless of whether the IP address falls in a VPN range. Treat the VPN as a transport tunnel, not a passport.

Palo Alto will continue to update its advisory as more information surface. Keep an eye on the security portal for any additional guidance or IOCs. And if you haven’t already, start mapping out a zero‑trust access model—because the next VPN flaw is already being written.