PAN-OS GlobalProtect Authentication Bypass — CVE-2026-0257

CVE-2026-0257 is an authentication bypass in the GlobalProtect portal and gateway components of PAN-OS. An unauthenticated attacker can circumvent security controls and initiate a VPN connection without valid credentials. Palo Alto Networks Unit 42 has observed active exploitation by an unidentified actor attempting to access GlobalProtect; the advisory and IOCs published 9 June 2026. As of reporting, no post-access lateral movement had been observed — meaning defenders have a window to catch this at the VPN-edge before it turns into a foothold.

The published indicators are unusually clean to hunt on: the early (pre-PoC) exploitation traffic came from a fixed set of source IPs and the connecting "endpoints" carried hard-coded, PoC-flavored fingerprints — placeholder MAC addresses (aa:bb:cc:dd:ee:ff, 00:11:22:33:44:55), template hostnames (WINDOWS-LAPTOP-001, DESKTOP-GP01, GP-CLIENT), a hard-coded Windows 10 Pro 64-bit client OS string, and an empty domain field. Real corporate GlobalProtect clients almost never present those values, so they make high-fidelity hunt anchors.

The highest-value defensive angle is the GlobalProtect authentication/system logs on the firewall: a successful gateway session whose client metadata matches the PoC fingerprints, or that originates from the published IPs, is exploitation until proven otherwise. Because the firewall is an appliance without a Falcon sensor, the durable detection path is to forward GlobalProtect logs to NGSIEM and alert on those fingerprints.

Defender priority: Apply the Palo Alto fix for CVE-2026-0257 and, in parallel, search GlobalProtect logs now for the published source IPs and the hard-coded device fingerprints (template hostnames, placeholder MACs, empty domain). A match = treat as compromise and force re-auth.

Unit 42 notes the source IPs are pre-PoC indicators (early-exploitation infrastructure) and may rotate after public PoC release — treat IPs as perishable (detect, +3 mo) and lean on the behavioral fingerprints for durable coverage. Confirm the exact affected PAN-OS train against the PSIRT advisory for your version.

Hunt hypotheses (fidelity-ordered)

1. H1 (high): A GlobalProtect connection originated from one of the published exploitation IPs. T1190 / T1133
2. H2 (high): A GlobalProtect session presents a hard-coded PoC fingerprint — placeholder MAC, template hostname, or hard-coded OS string. T1190 / T1078
3. H3 (high): A successful gateway connection with an empty domain field or otherwise malformed client metadata. T1078
4. H4 (medium): A gateway session established without a corresponding successful authentication event — the bypass logic anomaly. T1190
5. H5 (medium): A spike of GlobalProtect connections from new/rare source ASNs or geographies. T1133
6. H6 (medium): Post-VPN internal activity from a VPN-pool address — scanning or lateral movement (if endpoint-covered). T1021 / T1046

Attack chain

⚠ Telemetry reality: The CQL in §8 assumes GlobalProtect logs are ingested into NGSIEM/LogScale (a custom repo). Field names depend on your PAN-OS parser — validate against your ingest. Q6 is a Falcon endpoint query for internal hosts.

• GlobalProtect logs (firewall / Panorama): filter for successful gateway connections from the published source IPs, and for sessions where the source-region/source-user is unexpected.
• Client metadata search: query GlobalProtect logs for the template hostnames (WINDOWS-LAPTOP-001, DESKTOP-GP01, GP-CLIENT), the placeholder MACs, and sessions with an empty domain field.
• Auth-vs-session correlation: list gateway sessions that have no matching successful authentication event — the bypass signature.
• Version/exposure check: confirm which firewalls run a GlobalProtect-enabled PAN-OS version affected by CVE-2026-0257 and whether the fix is applied; confirm the portal/gateway is only exposed where required.
• VPN-pool egress review: on internal firewall/NetFlow, look for scanning or SMB/RDP from VPN-pool addresses shortly after a suspect session.

The firewall is sensor-less, so the primary alerts are NGSIEM scheduled searches (Q1, Q2). Q6 becomes a Custom IOA on endpoints to catch any post-bypass internal movement.

1 — NGSIEM scheduled-search alert (LogScale) for Q1 + Q2 combined

# Schedule recurring; severity Critical; notify SOC on any result.
#repo=panos_globalprotect
| src_ip=/^(23\.128\.228\.6|104\.207\.144\.154|146\.19\.216\.(119|120|125)|179\.43\.172\.213|185\.195\.232\.139|198\.12\.106\.60|202\.144\.192\.47)$/
  OR @rawstring=/WINDOWS-LAPTOP-001|DESKTOP-GP01|GP-CLIENT|aa:bb:cc:dd:ee:ff|00:11:22:33:44:55/i

2 — Block the exploitation source IPs (PAN-OS CLI EDL/address-group)

# Add to a deny address-group applied on the GlobalProtect zone.
set address-group GP-CVE-2026-0257-BLOCK static [ \
  H-23.128.228.6 H-104.207.144.154 H-146.19.216.119 H-146.19.216.120 \
  H-146.19.216.125 H-179.43.172.213 H-185.195.232.139 H-198.12.106.60 \
  H-202.144.192.47 ]
# Reference this group in a top-of-rulebase deny for the GP interface.

3 — Respond to a confirmed bypassed session

# On the firewall (or via Panorama), for the offending user/IP:
#  1. Terminate the GlobalProtect session
request global-protect-gateway client-logout gateway <GW_NAME> user <USER> reason force
#  2. Block the source IP (see playbook 2)
#  3. Force MFA re-enrollment / credential reset for any impacted account

Known gaps: the firewall is sensor-less, so all edge coverage depends on forwarding GlobalProtect logs to NGSIEM (§12 Immediate). IOC IPs are pre-PoC and perishable — the behavioral fingerprints (Q2/Q3) carry durable coverage. No post-access TTPs were published, so Q6 is a precautionary net rather than a confirmed-behavior detection. Validate parser field names before promoting any query.

Confirm the exact affected PAN-OS version train and the fixed release against the Palo Alto PSIRT advisory for your deployment before patching.