CVE-2026-0257

CRITICAL KEV NUCLEI

PAN-OS: GlobalProtect Authentication Bypass Vulnerabilities

Title source: cna
STIX 2.1

Exploitation Summary

CVE-2026-0257 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added May 29, 2026. EIP tracks 9 public exploits from researchers including grayxploit, tushargurav28, sfewer-r7. A Nuclei detection template is also available.

AI-analyzed exploit summary This repository contains a scanner for CVE-2026-0257, which targets PAN-OS GlobalProtect authentication bypass vulnerabilities. The tool detects vulnerable instances by forging authentication override cookies and testing them against GlobalProtect endpoints.

Description

Authentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS® software allows the attacker to bypass security restrictions and establish an unauthorized VPN connection. Panorama and Cloud NGFW are not impacted by these issues.

Exploits (9)

github SCANNER 1 stars
by grayxploit · pythonremote
https://github.com/grayxploit/CVE-2026-0257

This repository contains a scanner for CVE-2026-0257, which targets PAN-OS GlobalProtect authentication bypass vulnerabilities. The tool detects vulnerable instances by forging authentication override cookies and testing them against GlobalProtect endpoints.

Classification
Scanner 95%
Attack Type
Auth Bypass
Complexity
Moderate
Reliability
Reliable
Target: Palo Alto Networks PAN-OS GlobalProtect
No auth needed
Prerequisites: Access to the target GlobalProtect endpoint · TLS certificate chain extraction
devstral-2 · analyzed Jun 10, 2026 Full analysis →
github WORKING POC 1 stars
by tushargurav28 · pythoninfoleak
https://github.com/tushargurav28/CVE-2026-0257

This repository contains a functional exploit for CVE-2026-0257, a critical authentication bypass vulnerability in Palo Alto GlobalProtect VPN. The exploit forges a valid authentication cookie using the server's public RSA key extracted from its TLS certificate, allowing unauthenticated VPN access.

Classification
Working Poc 95%
Attack Type
Auth Bypass
Complexity
Moderate
Reliability
Reliable
Target: Palo Alto GlobalProtect VPN (PAN-OS 10.1 < 10.1.14-h9, 10.2 < 10.2.13-h3, 11.0 < 11.0.6-h2, 11.1 < 11.1.5-h2, 11.2 < 11.2.4-h4)
No auth needed
Prerequisites: Network access to the GlobalProtect portal/gateway · Server's TLS certificate (public RSA key)
devstral-2 · analyzed Jun 03, 2026 Full analysis →
github WORKING POC 1 stars
by sfewer-r7 · pythonremote
https://github.com/sfewer-r7/CVE-2026-0257

This repository contains a functional exploit PoC for CVE-2026-0257, which demonstrates an authentication bypass vulnerability in Palo Alto Networks GlobalProtect. The script forges a valid authentication override cookie using the public key from the TLS certificate chain and tests it against the target GlobalProtect portal or gateway.

Classification
Working Poc 95%
Attack Type
Auth Bypass
Complexity
Moderate
Reliability
Reliable
Target: Palo Alto Networks GlobalProtect (PAN-OS)
No auth needed
Prerequisites: Network access to the target GlobalProtect portal or gateway · Python 3.6+ with cryptography library
devstral-2 · analyzed May 29, 2026 Full analysis →
github SUSPICIOUS
by jenniferreire26 · poc
https://github.com/jenniferreire26/CVE-2026-0257

The repository claims to provide an exploit for CVE-2026-0257, an authentication bypass in Palo Alto Networks GlobalProtect portal, but lacks actual exploit code. Instead, it directs users to an external download link (tinyurl.com), which is a common tactic for distributing malware or monetizing fake exploits.

Classification
Suspicious 95%
Attack Type
Auth Bypass
Complexity
Theoretical
Reliability
Theoretical
Target: Palo Alto Networks PAN-OS GlobalProtect portal
No auth needed
Prerequisites: reachable vulnerable target · predictable user/workflow context
devstral-2 · analyzed Jun 09, 2026 Full analysis →
nomisec WORKING POC
by bolubey · infoleak
https://github.com/bolubey/CVE-2026-0257

This repository contains a functional exploit PoC for CVE-2026-0257, which allows unauthenticated attackers to forge GlobalProtect authentication override cookies by extracting public keys from the TLS certificate chain and testing them against the target's login endpoint.

Classification
Working Poc 95%
Attack Type
Auth Bypass
Complexity
Moderate
Reliability
Reliable
Target: Palo Alto Networks PAN-OS and Prisma Access
No auth needed
Prerequisites: Authentication override feature enabled · Cookie encryption certificate reused with HTTPS service
devstral-2 · analyzed Jun 01, 2026 Full analysis →
nomisec SUSPICIOUS
by jennydokumi30 · poc
https://github.com/jennydokumi30/CVE-2026-0257

The repository claims to provide an exploit for CVE-2026-0257, an authentication bypass in Palo Alto Networks GlobalProtect portal, but contains no actual exploit code. Instead, it directs users to an external download link (tinyurl.com), which is a common tactic for distributing malware or monetizing fake exploits.

Classification
Suspicious 95%
Attack Type
Auth Bypass
Complexity
Theoretical
Reliability
Theoretical
Target: Palo Alto Networks PAN-OS GlobalProtect portal
No auth needed
Prerequisites: reachable vulnerable target · predictable user/workflow context
devstral-2 · analyzed Jun 01, 2026 Full analysis →
github WRITEUP
by 0xBlackash · poc
https://github.com/0xBlackash/CVE-2026-0257

This repository provides a detailed technical analysis of CVE-2026-0257, an authentication bypass vulnerability in Palo Alto Networks PAN-OS GlobalProtect. It includes severity scoring, affected versions, exploitation status, and mitigation strategies, but does not contain functional exploit code.

Classification
Writeup 95%
Attack Type
Auth Bypass
Complexity
Moderate
Reliability
Reliable
Target: Palo Alto Networks PAN-OS (GlobalProtect Portal & Gateway)
No auth needed
Prerequisites: GlobalProtect portal or gateway configured · Authentication override cookies enabled · Reused encryption/decryption certificate
devstral-2 · analyzed May 30, 2026 Full analysis →
github STUB
by HORKimhab · poc
https://github.com/HORKimhab/CVE-2026-0257

The repository contains only placeholder files (README.md, LICENSE, .gitignore, and a template file) with no actual exploit code or technical details about CVE-2026-0257. The README is a generic template with no specific information about the vulnerability or exploit.

Classification
Stub 95%
Attack Type
Other
Complexity
Theoretical
Reliability
Theoretical
Target: unknown
No auth needed
devstral-2 · analyzed May 30, 2026 Full analysis →
github SCANNER
by akashsingh0454 · pythonpoc
https://github.com/akashsingh0454/CVE-2026-0257-PoC

This repository contains a Python-based scanner for detecting CVE-2026-0257, an authentication bypass vulnerability in Palo Alto Networks PAN-OS GlobalProtect. The script performs passive, read-only checks to identify vulnerable versions and behavioral indicators without attempting exploitation.

Classification
Scanner 100%
Attack Type
Auth Bypass
Complexity
Moderate
Reliability
Reliable
Target: Palo Alto Networks PAN-OS GlobalProtect (versions 10.2, 11.1, 11.2, 12.1)
No auth needed
Prerequisites: Network access to the GlobalProtect portal/gateway · PAN-OS version in vulnerable range · Authentication override cookies enabled
devstral-2 · analyzed May 30, 2026 Full analysis →

Nuclei Templates (1)

Palo Alto Networks PAN-OS - Authentication Bypass
CRITICALVERIFIEDby dhiyaneshdk,sfewer-r7
Shodan: http.title:"GlobalProtect" port:443
FOFA: title="GlobalProtect"

References (3)

Core 3

Scores

CVSS v3 9.1
EPSS 0.5879
EPSS Percentile 98.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CISA SSVC

Vulnrichment
Exploitation active
Automatable no
Technical Impact total

Details

CISA KEV 2026-05-29
VulnCheck KEV 2026-05-29
ENISA EUVD EUVD-2026-30104
CWE
CWE-565
Status published
Products (15)
Palo Alto Networks/Cloud NGFW All
Palo Alto Networks/PAN-OS 10.2.0 - 10.2.18-h6, 10.2.16-h7, 10.2.13-h21, 10.2.10-h36, 10.2.7-h34
Palo Alto Networks/PAN-OS 11.1.0 - 11.1.15, 11.1.13-h5, 11.1.10-h25, 11.1.7-h6, 11.1.6-h32, 11.1.4-h33
Palo Alto Networks/PAN-OS 11.2.0 - 11.2.12, 11.2.10-h7, 11.2.7-h14, 11.2.4-h17
Palo Alto Networks/PAN-OS 12.1.0 - 12.1.7, 12.1.4-h6
Palo Alto Networks/Prisma Access 10.2.0 - 10.2.10-h36
Palo Alto Networks/Prisma Access 11.2.0 - 11.2.7-h13
paloaltonetworks/pan-os 10.2.7 (12 CPE variants)
paloaltonetworks/pan-os 10.2.8
paloaltonetworks/pan-os 10.2.9
... and 5 more
Published May 13, 2026
KEV Added May 29, 2026
Tracked Since May 14, 2026