CVE-2026-0257

What it actually does

This vulnerability allows an unauthenticated network attacker to bypass authentication controls on affected Palo Alto Networks PAN-OS GlobalProtect portal or gateway interfaces and establish an unauthorized VPN connection. Technically, the flaw undermines the trust boundary that normally requires valid user authentication before VPN session creation, potentially giving the attacker internal network reachability equivalent to a remote-access VPN user. Panorama and Cloud NGFW are not impacted, but PAN-OS deployments providing GlobalProtect portal or gateway services, Prisma Access deployments, and downstream products embedding affected PAN-OS components may be exposed.

Why it matters to the business

Because GlobalProtect is commonly internet-facing and provides direct remote access into internal networks, successful exploitation can turn the VPN service into an entry point for intrusion, lateral movement, data theft, ransomware staging, and disruption of business operations. The risk is urgent: the vulnerability is listed in CISA KEV, has a very high EPSS probability, is reported as actively exploited in the wild, and is associated with ransomware activity including Qilin/Agenda campaigns. Organizations subject to CISA timelines should remediate by 2026-06-01, and others should treat that date as a practical maximum deadline rather than a target.

How an attack unfolds

An attacker scans the internet for exposed GlobalProtect portals or gateways running affected PAN-OS versions. After identifying a vulnerable service, the attacker sends crafted requests that exploit the authentication bypass and cause the device to accept or establish a VPN session without valid credentials. Once connected, the attacker gains network-level access normally reserved for authenticated remote users. From there, the attacker can enumerate reachable internal services, attempt credential theft, pivot to other systems, deploy tooling, exfiltrate data, or enable ransomware operations. Reported exploitation context includes active in-the-wild abuse, social-engineering-assisted campaigns such as ClickFix/FakeCaptcha poisoning used in broader intrusion chains, and Qilin/Agenda ransomware deployment activity following initial access.

How to fix it

Upgrade affected PAN-OS, Prisma Access, and downstream appliance firmware to vendor-provided fixed releases as soon as they are available and applicable. Because no exact fixed versions were provided in the input, use the latest Palo Alto Networks and relevant OEM advisories for product-specific target versions, including Siemens Ruggedcom APE1808 firmware if applicable. Prioritize systems exposing GlobalProtect portal or gateway services to the internet. If immediate patching is not possible, reduce exposure by disabling unused GlobalProtect portals/gateways, restricting access to trusted source IP ranges, enforcing additional network-layer controls in front of the VPN service, segmenting VPN users away from sensitive internal services, and increasing monitoring for unauthorized VPN session creation. Confirm that Panorama and Cloud NGFW are not in scope for this issue, but do not assume managed PAN-OS firewalls are protected merely because Panorama itself is unaffected.

How to confirm the fix worked

Confirm exposure by inventorying all PAN-OS-based devices and services that have GlobalProtect portal or gateway enabled, including Prisma Access and OEM/downstream appliances. Verify the installed PAN-OS or firmware version against the vendor advisory and confirm it is at or above the fixed release for the relevant branch. From an external network perspective, confirm whether GlobalProtect portal or gateway interfaces remain reachable and whether exposure has been intentionally restricted. After remediation, validate that unauthenticated requests cannot establish a GlobalProtect session, that only valid authenticated users can create VPN tunnels, and that authentication, GlobalProtect, traffic, and user-mapping logs show consistent identity-to-session correlation. Review recent historical logs from at least the publication date forward, and preferably earlier based on log retention, because this issue is known to be actively exploited.

Typical attack path

1. Identify internet-exposed GlobalProtect portal or gateway services on affected PAN-OS-based products.
2. Fingerprint the service and version family to determine likely exposure.
3. Exploit the authentication bypass to create or use an unauthorized GlobalProtect VPN session.
4. Enumerate internal network ranges and services reachable through the VPN tunnel.
5. Attempt credential access, privilege escalation, or lateral movement from the VPN-accessible network segment.
6. Stage persistence, remote tooling, data collection, or ransomware payloads.
7. Exfiltrate data and/or deploy ransomware, depending on campaign objectives.

How to detect it

Investigate whether the vulnerability was already exploited by correlating GlobalProtect session logs with authentication, identity-provider, traffic, User-ID, endpoint, and network telemetry. Focus on successful VPN tunnel establishment where there is no matching successful authentication event, where the username is blank, malformed, unexpected, disabled, or not present in the identity source, or where a session appears after failed authentication. Review PAN-OS system, threat, traffic, authentication, GlobalProtect, HIP, and User-ID logs; management-plane logs such as GlobalProtect service logs where available; identity-provider logs for SAML/OIDC/RADIUS/LDAP authentication; and EDR logs from systems reached by VPN clients. Look for new or rare source IP addresses, unusual countries or ASNs, impossible-travel patterns, abnormal tunnel durations, repeated portal/gateway configuration downloads, unexplained HIP report submissions, and VPN users accessing internal systems they normally do not use. Post-connection indicators include internal port scanning, LDAP/SMB/RDP/WinRM/SSH probing, credential dumping alerts, new remote administration tools, suspicious PowerShell or shell activity, large archive creation, outbound data transfer, and ransomware staging. Because exploitation is active and associated with ransomware, retain and review logs from at least 2026-05-13 onward and prioritize any VPN-originated activity that precedes encryption, data exfiltration, or Qilin/Agenda-related artifacts.

• GlobalProtect portal
• GlobalProtect gateway
• /global-protect/login.esp
• /global-protect/getconfig.esp
• /ssl-vpn/login.esp
• /ssl-vpn/getconfig.esp
• gpsvc.log
• sslvpn-access.log
• subtype=globalprotect
• GlobalProtect gateway user login succeeded
• GlobalProtect portal user login succeeded
• GlobalProtect gateway user logout
• GlobalProtect client connected
• GlobalProtect tunnel established
• HIP report
• failed authentication
• auth-fail
• Qilin
• Agenda ransomware
• ClickFix
• FakeCaptcha

What your security team should do

• Immediately identify all internet-facing GlobalProtect portal and gateway services across PAN-OS, Prisma Access, and embedded/OEM deployments.
• Patch or upgrade affected systems on an emergency basis; treat the 2026-06-01 KEV due date as the latest acceptable deadline for regulated environments and a strong urgency signal for all others.
• If patching cannot be completed immediately, restrict GlobalProtect access to trusted networks, disable unused portals/gateways, and place compensating controls in front of exposed services.
• Hunt for successful GlobalProtect sessions that lack corresponding successful identity-provider, RADIUS, LDAP, SAML, certificate, or local authentication events.
• Review VPN-connected source IPs, usernames, device identifiers, HIP reports, tunnel assignments, and internal traffic for anomalies since at least 2026-05-13.
• Prioritize investigation of any VPN sessions followed by internal scanning, credential access, remote administration tool execution, unusual SMB/RDP/WinRM/SSH activity, or mass file access.
• Reset credentials and revoke sessions/tokens for accounts associated with suspicious VPN activity, and rotate secrets if lateral movement is suspected.
• Increase monitoring for Qilin/Agenda ransomware tradecraft and for intrusion chains involving ClickFix or FakeCaptcha-style social engineering where endpoint telemetry is available.
• Ensure GlobalProtect users are segmented with least-privilege network access rather than broad internal reachability.
• Preserve firewall, GlobalProtect, authentication, traffic, User-ID, endpoint, and identity-provider logs before retention windows expire.