Palo Alto VPN Flaw Turns GlobalProtect Into the New Front Door for Attackers

Free Claude Code Course with Lydia Hallie, Anthropic (Sponsor)

We partnered with Anthropic to make our Claude Code course free for everyone. No subscription, no trial. Just dive in.

It’s taught by Lydia Hallie, who’s been an instructor with us for years and now works on the Claude Code team at Anthropic. When she taught Claude Code live, it broke every platform record we have with over 10,000 people tuning in.

Lydia has a knack for visualizing how tools work under the hood, which is exactly the mental model you need to stop guessing with AI and start directing it.

Learn Claude Code for free!

Palo Alto Networks has confirmed active exploitation of CVE-2026-0257, an authentication bypass vulnerability affecting the GlobalProtect portal and gateway components in PAN-OS. In practical terms, the flaw can allow a remote attacker to bypass authentication controls and establish an unauthorized VPN connection into an enterprise environment. Palo Alto rates the issue as High severity, CVSS 7.8, with “Highest” suggested urgency, while Rapid7 has urged organizations to treat it as critical because it affects internet-facing VPN infrastructure.

The important nuance: this does not affect every Palo Alto deployment. Palo Alto says exposure depends on GlobalProtect being configured with authentication override cookies and a specific certificate configuration. Panorama and Cloud NGFW are not impacted, while affected PAN-OS branches include 10.2, 11.1, 11.2, 12.1 and some Prisma Access deployments before fixed versions.

Rapid7 says its MDR team observed successful exploitation across multiple customers, with the earliest observed activity on May 17, 2026. The activity involved suspicious cookie-based authentication to a local admin account, and Rapid7 said it did not observe successful lateral movement in those cases. The vulnerability has also been added to CISA’s Known Exploited Vulnerabilities catalog, which turns it from “patch soon” into “prioritize now.”

Why this matters beyond Palo Alto

The bigger story is that attackers are increasingly targeting the systems that decide who gets inside the network. VPN gateways, firewalls, identity bridges, SASE connectors, and remote access appliances sit at the edge of the enterprise. If those systems fail, attackers do not need to phish a user, steal a password, or defeat MFA in the normal way. They may be able to enter through the infrastructure that was supposed to enforce trust.

That is why this flaw is more dangerous than its technical score alone suggests. A vulnerability in an internal app may expose one workload. A vulnerability in an enterprise VPN gateway can create a path into the corporate network, cloud resources, internal applications, admin panels, and identity-connected services.

“Authenticated Access” is only as strong as the appliance enforcing it

For years, enterprises treated VPN access as a controlled, authenticated doorway. But this incident shows a harsh reality: when the gateway itself has an authentication bypass, identity policies downstream may never get the chance to work.

This is especially relevant in hybrid environments where VPNs still connect employees, contractors, developers, support teams, OT networks, and cloud workloads. Even companies that have adopted Zero Trust often still keep legacy VPN infrastructure for special cases, privileged access, regional offices, or fallback connectivity.

The lesson for CISOs is clear: remote access infrastructure must be monitored like a Tier-0 identity system, not just like a network box.

Implications for key tech industry players

For Palo Alto Networks

Palo Alto’s challenge is not only patching the bug. It also has to preserve customer trust in GlobalProtect as a secure remote access layer. The company has issued fixed versions and recommends mitigations such as disabling authentication override or using a dedicated certificate for authentication override cookies.

But this incident will likely increase scrutiny around how security vendors handle cookie validation, certificate reuse, backward compatibility, and “convenience” features that reduce login friction. Features designed to make access smoother can become dangerous when their trust assumptions break.

For enterprise CISOs and security teams

This should trigger an immediate review of VPN exposure, not just a patch ticket. Security teams should identify all GlobalProtect portals and gateways, confirm whether authentication override cookies are enabled, verify certificate configuration, apply fixed PAN-OS versions, and hunt for suspicious GlobalProtect logins.

The most important operational takeaway: do not stop at patching. Review logs for successful VPN sessions from unusual infrastructure, generic hostnames, odd MAC addresses, unexpected Linux clients, local admin logins, and cookie-based authentication events. Unit 42 has also published indicators of activity for defenders to hunt against.

For MDR, XDR, and SIEM vendors

This is a strong use case for managed detection and response. Rapid7’s detection came from suspicious VPN authentication behavior, not simply a vulnerability scan. That matters because edge-device exploitation often produces subtle signals: strange login patterns, abnormal source IPs, non-human identities, unexpected VPN clients, and successful access without the usual user journey.

Security vendors that can correlate VPN logs, identity telemetry, endpoint activity, and cloud access will have an advantage. The market is moving from “detect malware on endpoints” to “detect abuse of trust infrastructure.”

For SASE and Zero Trust vendors

SASE and ZTNA vendors will likely use this incident to argue that legacy VPNs remain risky. But they should be careful: this is not simply a “VPN is dead” moment. Any access broker can become a high-value target if it holds authentication state, certificates, session cookies, routing control, or policy enforcement logic.

The winning message is not “replace VPN with our box.” It is: access systems need continuous validation, segmentation, device posture checks, short-lived credentials, strong telemetry, and rapid patchability.