PAN-OS GlobalProtect cookie bypass exposes VPN trust assumptions

At a glance

What this is: This is an analysis of CVE-2026-0257, a PAN-OS GlobalProtect authentication bypass that allows forged override cookies to create unauthorized VPN sessions.

Why it matters: It matters because internet-facing VPN portals sit directly in the access path, so identity and network teams need to treat cookie integrity, certificate reuse, and post-authentication access as one control surface.

By the numbers:

• CVE-2026-0257 carries a CVSS base score of 7.8, indicating high severity for exposed GlobalProtect deployments.
• Exposure in the observed set is led by Industrials at 25.3% of assets, showing how remote-access sprawl concentrates risk in distributed environments.

👉 Read CYCOGNITO's analysis of the PAN-OS GlobalProtect authentication bypass

Context

PAN-OS GlobalProtect authentication bypass is a trust-control failure, not a password problem. The issue matters because a forged override cookie can satisfy the portal or gateway's authentication expectation and place a remote user onto an internal VPN segment without the usual identity proof.

In identity security terms, this is a boundary-control weakness where session acceptance matters as much as initial login. The article's exposure patterns show that edge appliances with legacy settings and reused certificates can remain reachable long after teams assume the control path is safe; that is a common enterprise failure mode, not an outlier.

Key questions

Q: What breaks when GlobalProtect override cookies are not properly validated?

A: The portal or gateway may accept a forged cookie as proof of authentication, which lets an attacker open a VPN session without valid credentials. That turns a remote access convenience feature into a trust bypass. The result is unauthorized internal network entry, not just a failed login event.

Q: Why do edge VPN appliances create outsized identity risk?

A: They sit at the boundary between public traffic and internal trust, so any authentication weakness can become direct access. When the device issues a trusted session, it acts like an identity broker. If that trust path is weak, the attacker bypasses the perimeter and lands inside the network.

Q: How do security teams know whether a VPN bypass issue is actually dangerous in their environment?

A: They need to check three things together: internet exposure, affected software version, and the configuration flags that enable the vulnerable path. A device can be technically vulnerable but not reachable, or reachable but not bypassable. The dangerous combination is exposed, configured, and unmanaged.

Q: Who is accountable when a remote-access control allows unauthorised VPN sessions?

A: Accountability usually spans infrastructure, identity, and platform owners because the failure crosses certificates, session validation, and exposure management. NIST CSF and NIST SP 800-53 both expect clear access control ownership, and that ownership must extend to edge devices that mint trusted sessions.

Technical breakdown

How forged override cookies bypass GlobalProtect authentication

CVE-2026-0257 works because the portal or gateway accepts an authentication override cookie without sufficient integrity validation. If an attacker can present a forged cookie that the appliance treats as valid, the device skips the normal credential check and establishes a VPN session. That makes the flaw an authentication bypass rather than a password-guessing problem. The attack is network-based, unauthenticated, and low complexity, so reachability is the main precondition. Once accepted, the session is treated as trusted and the attacker is assigned a VPN IP address, effectively moving from the public internet into the internal access plane.

Practical implication: validate cookie handling as a security control, not just a convenience feature, and disable authentication override where it is not required.

Why certificate reuse creates a validation gap

The vulnerability only appears when the certificate used to encrypt and decrypt the override cookie is reused for another purpose instead of being dedicated to that feature. That matters because shared cryptographic material increases the chance that trust boundaries blur across functions. A certificate that should only support one workflow ends up participating in another, which weakens the assurance that the cookie was both issued and protected for that specific purpose. In practice, the problem is not encryption alone but how keys, certificates, and validation logic are scoped across features on the same appliance.

Practical implication: assign dedicated certificates to cookie protection workflows and review whether any shared certificate usage undermines feature-specific trust.

How internet-facing VPN portals turn a config issue into internal access

GlobalProtect portals and gateways are edge services by design, so any weakness in their authentication path is externally reachable. The article shows that exposure is conditional, depending on configuration, enabled override cookies, and certificate reuse, which means asset inventory alone is not enough. Teams need configuration awareness at the same time as exposure awareness. Once the bypass succeeds, the attacker sits behind the firewall as a VPN user, which means the impact is not merely session fraud but internal network access with all the downstream privilege and segmentation concerns that follow.

Practical implication: combine external attack-surface monitoring with configuration checks so you can identify which edge VPN instances are actually bypassable.

Threat narrative

Attacker objective: The attacker wants unauthorised internal network access through a trusted VPN channel, enabling further reconnaissance or lateral movement.

1. Entry occurs when a remote attacker targets a reachable GlobalProtect portal or gateway over the network and presents a forged authentication override cookie.
2. Escalation follows when the appliance accepts the cookie as valid, bypasses the normal credential check, and assigns the attacker a VPN IP address.
3. Impact is unauthorized VPN access that places the attacker on the internal network behind the firewall with trusted remote-user status.

Breaches seen in the wild

• Gravity SMTP CVE-2026-4020 API Keys Exposure — CVE-2026-4020 in Gravity SMTP exposes API keys via single HTTP request across 100,000 WordPress sites.
• Gladinet Hard-Coded Keys RCE Exploitation — Actively exploited hard-coded keys in Gladinet CentreStack and Triofox enable remote code execution.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Cookie integrity is now an identity control, not a web detail. This vulnerability shows that session acceptance at the VPN edge can be just as important as primary authentication. When a forged artifact is enough to satisfy the portal, the control failure sits in the trust model, not the user credential. Practitioners should treat cookie validation as part of identity assurance, especially on exposed access gateways.

Conditional exposure is the governance gap most teams underestimate. The flaw is not universal across PAN-OS deployments, which makes unmanaged configuration drift the real risk amplifier. Reused certificates, enabled override cookies, and internet-facing portals combine into a reachable attack surface that often survives because no one owns the complete lifecycle of the setting. The practitioner lesson is to govern feature-level exposure, not just patch status.

Remote-access appliances need the same lifecycle discipline as privileged identities. A VPN gateway that can mint trusted sessions is effectively a high-value identity broker, yet many organisations manage it as infrastructure alone. That breaks the control model because identity assurance, certificate scoping, and external exposure all converge at the same device. Teams should align these controls with NIST CSF PR.AC and the NIST SP 800-53 identity and access families.

External attack-surface findings become more valuable when they connect to identity telemetry. CyCognito's exposure analysis is useful because it links a vulnerability to configuration conditions and real-world asset distribution. That is the kind of evidence security leaders need to prioritise remediation across distributed estates. The broader lesson is that edge access controls should be measured as identity risk, not only as perimeter risk.

From our research:

• 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to the Ultimate Guide to NHIs.
• Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them.
• Forward look: Explore The 52 NHI breaches Report for breach patterns that show how weak identity lifecycle controls amplify compromise paths.

What this signals

Cookie-based trust is becoming part of the identity governance surface. VPN and gateway controls are no longer separate from IAM because they decide when a session is accepted as trusted. Teams should review edge appliances alongside other identity brokers, using [NIST SP 800-53 Rev 5 Security and Privacy Controls](https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final) as a control reference for access and authentication governance.

Configuration drift is the hidden multiplier in remote-access exposure. The most important programme signal is not simply whether a vulnerability exists, but whether old settings, reused certificates, and stale exceptions still make it exploitable. That is where the [Ultimate Guide to NHIs](https://nhimg.org/the-ultimate-guide-to-non-human-identities) matters, because lifecycle gaps are what keep trust shortcuts alive.

Identity teams should treat external attack-surface data as a prioritisation input, not a separate function. When exposed gateways can be tied to specific configuration conditions, remediation becomes a governance problem with measurable scope. The practical next step is to align remediation queues with the devices most likely to accept a forged session.

For practitioners

• Inventory every internet-facing GlobalProtect instance Build a live list of portals and gateways, then confirm which are actually reachable from untrusted networks and whether they are running affected PAN-OS trains. Pair the inventory with ownership so someone is accountable for each exposed edge device.
• Disable authentication override where the feature is not required If the business does not need override cookies, remove that path entirely rather than leaving a dormant trust shortcut in production. This reduces the chance that a legacy setting survives long after its original use case has disappeared.
• Separate cookie protection certificates from other uses Use a dedicated certificate for override cookie encryption and decryption, and verify that no other feature shares it. Shared certificates weaken feature-level trust boundaries and make it harder to reason about what a cookie really proves.
• Monitor VPN sessions for abnormal source patterns Alert on unexpected VPN logins, unusual source addresses, and session establishment events that do not match normal user geography or timing. Correlate those signals with public exposure so you can prioritize the instances most likely to be abused.
• Tighten external access while patches are staged Restrict portal and management access to trusted networks where feasible, then move quickly to the fixed PAN-OS releases appropriate to each installed train. The fastest reduction in risk comes from shrinking reachability before the bypass can be exercised.

Key takeaways

• CVE-2026-0257 is an authentication bypass that turns a forged cookie into unauthorised VPN access.
• The exposure risk is shaped by configuration drift, certificate reuse, and whether the portal or gateway is actually internet reachable.
• Teams should treat edge VPN session validation as an identity control and remove unnecessary override paths now.

Key terms

• Authentication override cookie: An authentication override cookie is a session artifact a gateway uses to recognise that a user has already authenticated. When poorly designed or improperly signed, it becomes a replayable proof of access. The risk is not the cookie itself, but the fact that the gateway may treat it as sufficient evidence for network reachability.
• Edge Identity Broker: An edge identity broker is a system that decides whether external traffic may enter an internal trust zone, often by issuing or validating sessions. VPN gateways, portals, and access appliances behave like identity brokers when they convert a network request into a trusted user session.
• Configuration Drift: Configuration drift is the gradual divergence between a system's intended secure state and the settings it actually runs with over time. In SaaS, drift often appears when admins change sharing, logging, or access controls under pressure and never return to validate the result.
• Identity Boundary: The point in an application where authentication and authorisation decisions are enforced. In Node.js systems, this often sits in APIs, middleware, and session handling code, making it the place where governance, runtime behaviour, and security evidence intersect.

What's in the full report

CYCOGNITO's full analysis covers the operational detail this post intentionally leaves for the source:

• Affected PAN-OS and Prisma Access version ranges, including the exact fixed releases by train
• The configuration conditions that make the issue exploitable, including override cookie settings and certificate reuse
• Step-by-step remediation guidance for staging patches and validating re-authentication behaviour after upgrade
• CyCognito's asset-exposure patterns across sectors, which help teams prioritise remediation in distributed estates

👉 CYCOGNITO's full post covers affected versions, exposure conditions, and remediation steps for vulnerable GlobalProtect deployments.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps security and identity practitioners build the lifecycle controls needed to govern trusted access paths like VPN sessions.