Palo Alto GlobalProtect VPN Authentication Bypass Confirmed Under Active Exploitation

Palo Alto Networks firewalls running GlobalProtect VPN are being actively exploited right now. CVE-2026-0257 lets an attacker create a fake VPN login cookie and authenticate as a legitimate user — without a password. Exploitation was first observed by Rapid7 on May 17 across multiple businesses simultaneously, and CISA added it to its must-patch list on May 29. The vulnerability only triggers under a specific configuration: authentication override cookies must be enabled AND the same SSL certificate must be shared across multiple services. If that describes your setup, you are at risk. Palo Alto raised the severity rating to High after confirming active exploitation. The fix is straightforward: either patch PAN-OS to the current release, turn off the authentication override cookie feature, or generate a dedicated certificate used exclusively for that feature. Check your GlobalProtect logs for successful logins from unfamiliar hostnames or the local administrator account. No significant lateral movement has been confirmed yet from known victims, but that window will not stay open long.