What Actually Happened

Palo Alto Networks announced that a medium-severity vulnerability, CVE-2026-0257, affecting PAN-OS and Prisma Access, is currently being exploited in the wild. This authentication bypass flaw allows attackers to establish unauthorized VPN connections through the GlobalProtect portal and gateway when specific conditions, including authentication override cookies and certain certificate configurations, are present.

The Implementation Reality

For teams operating PAN-OS devices with GlobalProtect configurations, this vulnerability poses a significant risk. It specifically affects environments where authentication override cookies are enabled, which may be common in certain configurations for ease of access. Given the reported active exploitation, including instances of VPN IP assignment allowing attackers access to internal networks, organizations must act swiftly. Any unpatched devices are at heightened risk, particularly as multiple exploit attempts have been documented. Teams should assess their current configurations and consider the implications of the vulnerability on their security posture, including potential unauthorized access to sensitive data and resources.

What to Do About It

• Immediately review and apply the latest vendor-supplied patches from Palo Alto Networks to mitigate the vulnerability.
• If patching cannot be accomplished quickly, disable the authentication override feature on affected devices as a temporary measure.
• Generate a new certificate specifically for use with the authentication override feature to limit exposure.
• Conduct a security audit of existing VPN configurations to identify any additional vulnerabilities or misconfigurations that could be exploited.
• Monitor logs and network traffic for any signs of unauthorized VPN connections or abnormal behavior indicative of exploitation attempts.

Source: The Hacker News

At q52, we specialize in AI-augmented security operations and SIEM implementation. Let us help you operationalize threat detection with LLM enrichment — faster triage, fewer false positives, and security intelligence your team can actually act on. Learn about Noogenesis, our AI-powered SIEM platform and connect with us on LinkedIn.