Executive Summary
CVE-2026-0257 is an authentication bypass in the PAN-OS GlobalProtect portal and gateway. It applies only when Authentication Override is enabled and the certificate used for override cookies is also used elsewhere, such as the portal or gateway HTTPS service. Rapid7 reports that the firewall trusts the decrypted cookie without checking a signature, so an attacker can take the public key from the TLS certificate chain and forge a valid cookie. Palo Alto Networks published fixes on 13 May 2026 with a medium rating that was later raised to a CVSSv4 score of 7.8. Rapid7 saw successful exploitation from 17 May and a proof of concept became public on 29 May.
In its October update Unit 42 reports that ransomware operators tracked as Spikey Scorpius (Qilin) and Tarnished Scorpius (Inc) use the flaw for initial access. Reported steps are a VPN session without the normal second factor, RMM tools for discovery and RDP and SMB for lateral movement. In one notable case the operator moved from the VPN to vCenter, disabled ESXi security controls (execInstalledOnly) and dumped credentials offline from a domain controller's virtual disk, which avoids in-guest EDR. Unit 42 also lists a Veeam exploit (CVE-2023-27532) among the tools chained in these intrusions. ReliaQuest links Settra ransomware to the flaw, which Unit 42 does not confirm.
Exposure depends on configuration. Check for Authentication Override with a shared cookie certificate, then apply a fixed release or disable the feature.