May 30, 2026 Medium Confidence

Palo Alto GlobalProtect VPN auth bypass flaw now exploited in attacks

By Overwatch Observatory — Automated Detection Engineering

Threat Overview

BleepingComputer recently reported active exploitation of a Palo Alto GlobalProtect VPN authentication bypass flaw, CVE-2026-0257. This vulnerability allows attackers to forge authentication override cookies, effectively bypassing authentication and gaining access, specifically targeting local administrator accounts. This represents a critical initial access vector (T1190) for adversaries to establish a foothold within an environment.

To detect this activity, we developed a KQL query that focuses on anomalous successful VPN authentications by privileged accounts (T1078.001). Our query targets the CommonSecurityLog table, specifically filtering for events where DeviceVendor is "Palo Alto Networks" and DeviceProduct contains "GlobalProtect". We then look for successful authentication activities and narrow down the results to DestinationUserName values that match common administrator account names like "admin" or "administrator".

The query aggregates these successful administrative logins by DestinationUserName, SourceIP, and other relevant fields, providing a summarized view of potentially malicious activity. Defenders can deploy this query in their environments to identify instances where administrative accounts successfully authenticate to GlobalProtect VPNs from unusual or unexpected source IPs, which could indicate exploitation of CVE-2026-0257. This behavioral detection helps us identify the outcome of the exploit even without specific IOCs.

We recommend that defenders regularly monitor for successful GlobalProtect VPN authentications by administrative accounts, especially those originating from external or unusual IP addresses. Tuning the `admin_usernames` list to reflect specific privileged account names in your environment will enhance the fidelity of this detection. Anomalous successful logins by these accounts should trigger immediate investigation.

Source

Threat Intelligence Source

https://www.bleepingcomputer.com/news/security/palo-alto-globalprotect-vpn-auth-bypass-flaw-now-exploited-in-attacks/

BleepingComputer

Detection Rules

Initial Access / T1190

The core of the attack described is the exploitation of CVE-2026-0257 on a public-facing Palo Alto GlobalProtect VPN gateway. The attacker's action is to bypass authentication and gain initial access to the internal network. The article explicitly states that attackers targeted the 'local administrator account'. Therefore, a detection that looks for successful VPN authentications by administrative accounts directly hunts for the successful outcome of this attacker technique.

KQL

let admin_usernames = dynamic(["admin", "administrator", "paloalto", "root", "localadmin"]);
CommonSecurityLog
| where DeviceVendor == "Palo Alto Networks"
| where DeviceProduct has "GlobalProtect"
| where isnotempty(Activity) and Activity has_all("GlobalProtect", "authentication", "success")
| where DestinationUserName in~ (admin_usernames)
| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), EventCount = count() by DestinationUserName, SourceIP, RemoteIPCountry, Message, DeviceName
| extend timestamp = StartTime, AccountCustomEntity = DestinationUserName, IPCustomEntity = SourceIP

Verified against live Sentinel — May 30, 2026

What This Catches

This detection logic targets specific behavioral indicators mapped to the MITRE framework as identified in the source intelligence.

MITRE ATT&CK

Tactics

Initial Access

Techniques

T1190

Want This Detection in Your Environment?

Overwatch deploys and manages detection rules like this across your Microsoft Sentinel workspace, with continuous tuning and 24/7 monitoring.

Book a Consultation