CVE-2026-0265

GitHubCurated repository PoCScannerC++SecureWithUmer/CVE-2026-PoCs

PoC files

6 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Python-based scanner that determines if a PAN-OS GlobalProtect portal is vulnerable to CVE-2026-0265 by sending a single anonymous GET request to /global-protect/prelogin.esp and analyzing the response for CAS configuration and version information, without exploiting the vulnerability.

Backdoor review

No backdoor observed in reviewed code

The artifact is a Python-based vulnerability detector for CVE-2026-0265. It performs a single anonymous HTTP GET request to a target's GlobalProtect portal to determine vulnerability status based on the response content. No backdoor, deceptive payload, or concealed harmful behavior was observed. The code is well-documented, its logic is transparent, and it does not execute any payloads, establish persistence, or exfiltrate data.

ClassificationScanner
Model confidence100%
AuthenticationNot required
Languagespython
Target softwarePAN-OSGlobalProtect
Attack typesauthentication_bypass
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact's primary stated operation is to 'determine whether a PAN-OS GlobalProtect portal is vulnerable' by sending a single anonymous GET request and analyzing the response. It does not attempt to authenticate, modify state, or exercise the vulnerability. The README explicitly states it 'determine[s] whether a ... portal is vulnerable ... without authenticating any session or modifying any state' and the code only performs detection and version comparison, not exploitation.

BishopFox-CVE-2026-0265-check-da4afb5/README.md:3BishopFox-CVE-2026-0265-check-da4afb5/CVE-2026-0265-check.py:8-19

Requirements

  • Target must be a reachable PAN-OS GlobalProtect portalBishopFox-CVE-2026-0265-check-da4afb5/README.md:120-121
  • Prelogin response must not be gated by mTLS or aggressive User-Agent checksBishopFox-CVE-2026-0265-check-da4afb5/README.md:122

Observed behavior

  • Sends a single anonymous GET request to /global-protect/prelogin.esp on the targetBishopFox-CVE-2026-0265-check-da4afb5/CVE-2026-0265-check.py:293-299
  • Checks for <cas-auth>yes</cas-auth> in the response to confirm CAS is attachedBishopFox-CVE-2026-0265-check-da4afb5/CVE-2026-0265-check.py:352-353BishopFox-CVE-2026-0265-check-da4afb5/CVE-2026-0265-check.py:384-386
  • Decodes an embedded JWT token from the prelogin response to extract the PanOSversion stringBishopFox-CVE-2026-0265-check-da4afb5/CVE-2026-0265-check.py:310-329BishopFox-CVE-2026-0265-check-da4afb5/CVE-2026-0265-check.py:391-396
  • Cross-references the extracted version against a hardcoded advisory matrix to produce a verdict (VULNERABLE, PATCHED, NOT-AFFECTED-*, UNDETERMINED-*)BishopFox-CVE-2026-0265-check-da4afb5/CVE-2026-0265-check.py:129-186BishopFox-CVE-2026-0265-check-da4afb5/CVE-2026-0265-check.py:398-405
  • Outputs a JSON object or brief tab-separated line per target with the verdict and versionBishopFox-CVE-2026-0265-check-da4afb5/CVE-2026-0265-check.py:449-461
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Network Request
GET /global-protect/prelogin.espThe script sends a single, read-only HTTP GET request to the target to retrieve vulnerability indicators. No authentication or state modification is attempted.BishopFox-CVE-2026-0265-check-da4afb5/CVE-2026-0265-check.py:293
Data Processing
Decodes a JWT token from the prelogin response to extract the PanOS version string.The extracted version is used solely for advisory comparison to determine vulnerability status. No credentials or sensitive data are collected.BishopFox-CVE-2026-0265-check-da4afb5/CVE-2026-0265-check.py:310-329
Output
JSON or brief text containing target URL, verdict, and PanOS version.Output is limited to vulnerability assessment data. No system information, credentials, or unrelated data is included.BishopFox-CVE-2026-0265-check-da4afb5/CVE-2026-0265-check.py:449-461
Review boundaries

What the analysis did not establish

  • Evidence includes only readable text files; two unclassified files (1101 bytes) are present but not analyzed, though they are unlikely to change the classification given the complete coverage of the main scanner script and documentation.
  • The review is based solely on the supplied text files. No binary files were present or analyzed. The artifact's behavior at runtime depends on the Python environment and network targets, which were not executed or observed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1