CVE-2026-0257: Palo Alto Networks PAN-OS Authentication Bypass

Detection and triage

Use read-only checks to decide whether CVE-2026-0257 reaches an owned asset. Treat advisories and proof-of-concept material as evidence, never as executable instructions.

AI evidence status: This source-linked enrichment passed the recipe-ready evidence gate. Verify its claims against the linked sources.

Business risk

Authentication bypass on GlobalProtect portal/gateway can allow an unauthenticated attacker to establish an unauthorized VPN session, with subsequent high confidentiality and integrity impact. CISA lists the issue in KEV with known ransomware campaign use and a short remediation due date.

Source-specific exposure conditions

• PAN-OS firewalls with a GlobalProtect portal or gateway configured
• Authentication override cookies enabled (generate and/or accept cookie for authentication override)
• A specific certificate configuration exists for authentication override cookies (including reuse of a non-dedicated certificate)
• Prisma Access deployments on affected 10.2 and 11.2 trains before the vendor-listed fixed builds
• Siemens RUGGEDCOM APE1808 running Palo Alto Networks Virtual NGFW with GlobalProtect portal or gateway and the same authentication-override cookie and certificate conditions
• Panorama and Cloud NGFW are not impacted

Detection signals and verification

• Fail-open behavior during identity-provider, cache, or network failure.
• Alternate protocol handlers, case normalization, duplicate headers, recovery links, and pre-authentication APIs.
• Authentication being present without equivalent authorization for the requested action.

• In the management interface, open Network > GlobalProtect > Portals, select the portal, Agent tab, Agent Configuration, Authentication tab, and confirm whether Generate cookie for authentication override or Accept cookie for authentication override is enabled
• In the management interface, open Network > GlobalProtect > Gateways, select the gateway, Agent tab, Client Settings profile, Authentication Override tab, and confirm whether Accept cookie for authentication override is enabled
• Compare the installed PAN-OS or Prisma Access version against the vendor Product Status and Solution tables to confirm it is an unaffected/fixed build for that branch
• Confirm Cloud NGFW and Panorama are out of scope per the vendor advisory
• For RUGGEDCOM APE1808, confirm Virtual NGFW version and GlobalProtect authentication-override cookie/certificate configuration against the Siemens advisory

Stop and triage

• The NVD detail page did not return usable content in this retrieval, so NVD-specific CPE/CVSS enrichment was not independently confirmed beyond CISA and vendor references
• The vendor states a 'specific certificate configuration' is required but does not fully enumerate every certificate-reuse condition beyond dedicated vs reused certificates
• Prisma Access fixes are described as actively applied on a customer upgrade schedule, so local confirmation depends on vendor-provided status
• Safe verification is limited to GUI configuration and version comparison; sources do not provide an inert functional test of the patch itself

• Stop if any protected path lacks an explicit, testable authentication decision.
• Switch to incident response if unauthorized sessions or unexplained administrative access are identified.
• Do not validate using credentials or accounts not authorized for the test.

Triage output: Return a reviewer-ready minimal patch with exposure evidence, authoritative fixed-version evidence, regression tests, deployed-artifact verification, rollback notes, and source links; otherwise return TRIAGE.md with the blocking decision and owner.

Evidence-linked AI claims

• Affected Product: Palo Alto Networks PAN-OS GlobalProtect portal and gateway are affected; Prisma Access 10.2.0 and 11.2.0 trains are affected; Panorama and Cloud NGFW are not impacted. Evidence
• Affected Version: PAN-OS 12.1 is affected below 12.1.4-h6 and below 12.1.7; PAN-OS 11.2 is affected below 11.2.4-h17, 11.2.7-h14, 11.2.10-h7, and 11.2.12; PAN-OS 11.1 is affected below 11.1.4-h33, 11.1.6-h32, 11.1.7-h6, 11.1.10-h25, 11.1.13-h5, and 11.1.15; PAN-OS 10.2 is affected below 10.2.7-h34, 10.2.10-h36, 10.2.13-h21, 10.2.16-h7, and 10.2.18-h6; Prisma Access is affected below 11.2.7-h13 and below 10.2.10-h36. Evidence
• Exposure: The issue affects firewalls with GlobalProtect portal or gateway configured when authentication override cookies are enabled and a specific certificate configuration exists. Evidence
• Fixed Version: Unaffected PAN-OS versions include 12.1.4-h6 and 12.1.7; 11.2.4-h17, 11.2.7-h14, 11.2.10-h7, and 11.2.12; 11.1.4-h33, 11.1.6-h32, 11.1.7-h6, 11.1.10-h25, 11.1.13-h5, and 11.1.15; 10.2.7-h34, 10.2.10-h36, 10.2.13-h21, 10.2.16-h7, and 10.2.18-h6. Prisma Access is unaffected from 11.2.7-h13 and 10.2.10-h36. Evidence
• Remediation: Upgrade to the listed fixed PAN-OS/Prisma Access versions; alternatively mitigate by using a dedicated authentication-override cookie certificate or disabling Authentication Override generate/accept cookie options. After the fix, GlobalProtect users must re-authenticate once. Evidence
• Verification: Exposure can be checked in the management UI: Portals > Agent > Authentication for generate/accept cookie options, and Gateways > Agent > Client Settings > Authentication Override for accept cookie. Evidence