CVE-2026-0257: Rapid7 Caught Attackers Abusing Forged VPN Cookies Against Multiple Customers

CVE-2026-0257 lets attackers forge Palo Alto GlobalProtect auth cookies and bypass VPN login. Exploitation confirmed since May 17.

Palo Alto Networks addressed the vulnerability CVE-2026-0257 on May 13. Two weeks later, cybersecurity firm Rapid7 confirmed active exploitation across multiple customer environments.

The flaw impacts the GlobalProtect portal and gateway components of Palo Alto Networks PAN-OS and allows attackers to bypass authentication and establish unauthorized VPN connections. The vulnerabilities do not affect Panorama or Cloud NGFW deployments.

“Authentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS® software allows the attacker to bypass security restrictions and establish an unauthorized VPN connection.” reads the advisory.

If the same certificate is used for both the HTTPS service and the cookie encryption feature, which is a common misconfiguration, an attacker can grab the public key straight from the HTTPS session. Armed with that key, they can craft a cookie for any user, including the local admin account, that the device will accept as perfectly legitimate. No credentials required. Rapid7’s Labs team built a proof-of-concept script that demonstrates this in full: retrieve the certificate chain, iterate through each certificate, forge a cookie, test it. The whole attack takes seconds against a vulnerable appliance.

“If we look at the main_DecryptAppAuthCookie function we can begin to see the problem.” reads the report published by Rapid7. “The incoming encrypted cookie is base64 decoded and then decrypted using a private key. The decrypted content is then trusted implicitly, with no signature verification of any kind occurring after decryption.”

Rapid7 MDR caught the first wave of exploitation on May 18 at 01:51 UTC, originating from infrastructure hosted by Vultr. The logs showed cookie-based authentication to the local admin account across several customer environments, using the hostname “GP-CLIENT” on a Linux system and a spoofed MAC address of aa:bb:cc:dd:ee:ff.

A second wave hit on May 21, this time from Dromatics Systems, using the hostname “DESKTOP-GP01” and the same spoofed MAC address. The consistent MAC address across both waves is what led Rapid7 to assess that a single threat actor was behind both campaigns.

“Due to the consistent MAC address, Rapid7 believes both waves of exploitation are likely from the same threat actor. However, the second wave of compromises originated from the hosting provider, Dromatics Systems.” continues the report. “In this wave of exploitation, Rapid7 observed VPN IP assignment following the cookie authentication, granting them access to the internal network.”

In the second wave, some victims did get a VPN IP assignment after the cookie was accepted, meaning the attacker gained access to the internal network.

“Rapid7 MDR identified successful exploitation across numerous customers, however we did not observe any indication of successful lateral movement from the devices.” states Rapid7. “The earliest date for observed exploitation was May 17, 2026”

In 8 out of 10 impacted customers, however, the appliance accepted the forged cookie without establishing a full VPN session. Why it worked completely for some victims and not others remains unclear.

The affected configurations share two traits: Cloud Authentication Service disabled, and authentication override cookies enabled with the cookie certificate shared with the HTTPS service. If your setup doesn’t match that description, you’re not exposed. If it does, patch immediately.

The fix is straightforward: upgrade to a patched PAN-OS version, or as a stopgap, either disable the authentication override feature entirely or generate a dedicated certificate used only for cookie encryption and not shared with any other service. Rapid7 has also published a public proof-of-concept script on GitHub that organizations can use to test whether their appliances are vulnerable before assuming they’re not. Indicators of compromise, including the attacker IP addresses and the two hostnames observed in logs, are published in Rapid7’s advisory.

Palo Alto initially rated this flaw as medium severity because it requires a specific configuration to be exploitable. Rapid7 disagreed from the start. An authentication bypass on an internet-facing enterprise VPN appliance, where a successful exploit lands an attacker directly inside your network, is not a medium-severity problem regardless of what the CVSS calculator says.

Rapid7 provided Indicators of Compromise (IoCs) for these attacks.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – Palo Alto GlobalProtect, CVE-2026-0257)