Attackers are forging a cookie to log into Palo Alto VPNs as any user, admin included. It was rated medium severity, and they were inside four days after the patch.

CVSS MEASURES THE BUG, NOT YOUR EXPOSURE

A severity score describes a vulnerability in the abstract. It does not know where the vulnerable thing sits, what it connects to, or who can reach it. For an internet-facing VPN appliance that brokers access to your internal network, those three facts are the entire risk, and none of them are in the number. CVE-2026-0257 is the clean illustration. It shipped with a rating that told a lot of teams it could go in the next maintenance window. The appliance it lives on is exposed to the entire internet and exists to grant network access. Attackers read the second fact, not the first.

This is the recurring blind spot with edge devices. Firewalls, VPN concentrators, load balancers, and mail gateways are the most exposed systems an organization runs, and they are routinely the least monitored. They do not take an endpoint agent. Their logs are sparse and often not forwarded anywhere. They are treated as infrastructure that either works or does not, rather than as software with an attack surface. So when a pre-authentication bug lands on one of them, the scoring rubric tends to undercount it and the security program tends to under-watch it. That combination is why edge appliances have become the preferred initial-access route for serious intruders. The bug does not have to be elegant. It has to be reachable, and this one is.

Palo Alto raised the severity from Medium to High only after Rapid7 reported real exploitation. The score caught up to reality after the attackers did. That is the wrong order, and it is worth internalizing before the next edge CVE lands.

WHAT THE FLAW ACTUALLY IS

GlobalProtect supports an authentication override feature that issues a signed cookie so users do not have to re-authenticate constantly. The cookie is encrypted and decrypted with a certificate configured on the portal or gateway. The vulnerability appears when that same certificate is reused for another purpose, most commonly the HTTPS service that the portal or gateway already presents to the internet.

When the certificate is shared, the public key an attacker needs is sitting in plain view. Any client that connects to the appliance over HTTPS is handed the TLS certificate as a normal part of the handshake. From that certificate the attacker extracts the public key, and because the same key material protects the authentication-override cookie, they can craft a cookie the appliance will accept. GlobalProtect validates the forged cookie, treats the request as an authenticated session, and assigns a VPN connection. The attacker chooses the identity, including the local administrator account. No password, no token, no prompt. The precondition is not exotic. Certificate reuse is a quiet configuration habit, the kind of thing that looks tidy and is invisible until it is a foothold.

Rapid7 confirmed this chain in the wild, validating it against a working proof-of-concept. They did not observe lateral movement from the compromised appliances, but that is cold comfort. The attacker already holds network-level access equivalent to a legitimate VPN user, which is exactly the position from which reconnaissance and staging begin.

WHAT A VPN FOOTHOLD ACTUALLY BUYS

It is tempting to read "no lateral movement observed" as "no real harm done." That misreads the position the attacker is in. A forged GlobalProtect session is not access to a single device. It is a seat on the internal network with the routing and reachability of a trusted remote employee, granted before any of the controls that assume a real person logged in. Conditional access, MFA, and device posture checks all sit upstream of where this attacker enters, so they never fire.

From that seat, the quiet work begins. Internal DNS and Active Directory become queryable. Internal web applications, admin consoles, and management interfaces that were never meant to face the internet are suddenly one hop away. The attacker can map the network, identify domain controllers and file shares, look for service accounts and cached credentials, and pick the softest path deeper, all while their traffic blends into the same VPN pool your actual staff use. The reason no lateral movement showed up in the early reporting is most likely timing, not restraint. Reconnaissance from a fresh foothold is patient and quiet by design, and it is the phase that decides how bad the rest of the intrusion gets.

This is why initial access on an edge VPN is valued so highly in criminal markets. It skips the noisy part. There is no phishing lure to land, no payload to detonate past an endpoint agent, no privilege escalation on a monitored workstation. The attacker simply arrives, authenticated, inside the perimeter, in the one spot the security stack is least prepared to question.

THE BLIND SPOT, DRAWN

The reason this works is not the cleverness of the bug. It is the coverage map. Organizations instrument the inside thoroughly and the edge barely at all, so the attacker enters through the one device nobody is watching and arrives among the ones everybody is.

EDGE APPLIANCES KEEP FAILING THE SAME WAY

Strip the Palo Alto specifics away and this story is familiar, because the security industry has lived it repeatedly. Internet-facing access appliances from every major vendor have shipped pre-authentication flaws that attackers weaponized within days, and the response cycle rhymes every time: a quiet advisory, a modest score, a delay while teams treat it as routine, then confirmed mass exploitation and an emergency scramble. The brand on the box changes. The shape does not.

The cause is structural, not a single vendor's failure. These devices are exposed to the entire internet by design, because that is their job. They are closed, monolithic systems that do not accept the endpoint agents the rest of the fleet runs, so the detection coverage that watches everything else stops at their edge. They are painful to patch, often sitting in high-availability pairs that require coordinated maintenance windows, which stretches the exposure window. Their logging is thin and frequently not forwarded anywhere useful. And they hold a privileged position in the network, brokering the access an attacker most wants. Every one of those traits independently raises risk. Together they describe the ideal target.

Attackers internalized this years ago and shifted effort to the edge accordingly. Many defenders still have not, and continue to treat the firewall and the VPN as appliances that either work or do not, rather than as exposed software with an attack surface that deserves the same scrutiny as a domain controller. CVE-2026-0257 is one more entry in a long list. The organizations that stop being surprised by it are the ones that decided to monitor and patch the edge as if it were the front line, because it is.

DETECTION AND HUNTING

You cannot put an endpoint agent on the firewall, so detection here means two things: actually forwarding the appliance's own logs somewhere the appliance does not control, and watching the network and identity layers for the signature of a forged session. The tell is an authentication that produces a VPN session without a corresponding real login: a cookie-based authentication to a privileged account, or a VPN assignment that does not line up with any genuine user activity. Start here and tune to your environment.

 title: GlobalProtect cookie auth to a privileged account (CVE-2026-0257) 
 # Forwards required: PAN-OS GlobalProtect auth + system logs to your SIEM. 
 # Flags cookie-based auth-override sessions to admin and repeated client MACs. 
logsource:
  product: panos
  service: globalprotect
detection:
  cookie_to_admin:
    auth_method: "auth-override-cookie"
    user|contains:
      - "admin"
      - "local"
  spoofed_client:
    event: "gateway-auth-success"
    client_mac|exists: true         # same MAC across many users = suspect 
  condition: cookie_to_admin or spoofed_client
level: high

The rule above catches the appliance side. The signals below catch the consequence, and they keep working even if the appliance logs nothing useful, because they are generated everywhere except on the device the attacker touched.

WHAT TO DO TODAY

INDICATORS AND TIMELINE