PAN-OS GlobalProtect CVE-2026-0257 authentication bypass is being exploited by ransomware groups: which versions are fixed and what's the workaround?

CVE-2026-0257 lets an attacker bypass authentication on a PAN-OS GlobalProtect portal or gateway and open VPN connections. Palo Alto Networks reports exploit attempts, and Unit 42 links exploitation to ransomware operators (Qilin, Inc). You're exposed if the portal has 'Generate cookie for authentication override' or 'Accept cookie for authentication override' checked, or the gateway has 'Accept cookie for authentication override' checked. Fixed versions (upgrade to at least the hotfix for your train): - 12.1: 12.1.4-h6, 12.1.7 - 11.2: 11.2.4-h17, 11.2.7-h14, 11.2.10-h7, 11.2.12 - 11.1: 11.1.4-h33, 11.1.6-h32, 11.1.7-h6, 11.1.10-h25, 11.1.13-h5, 11.1.15 - 10.2: 10.2.7-h34, 10.2.10-h36, 10.2.13-h21, 10.2.16-h7, 10.2.18-h6 If you can't upgrade yet: uncheck the authentication override options on the portal and gateway, or use a new certificate dedicated to authentication override cookies (never the portal/gateway certificate). Also make sure GlobalProtect isn't reachable through the management interface (Unit 42 notes ports 4443 and 3879 exposed this way). After patching, review GlobalProtect logs for gateway-connected events from unknown IPs or generic hostnames, then look for RDP/SMB lateral movement. Sources: https://security.paloaltonetworks.com/CVE-2026-0257 ; https://unit42.paloaltonetworks.com/active-exploitation-of-pan-os-cve-2026-0257/