Palo Alto Networks PAN-OS Authentication Bypass (CVE-2026-0257)

union CommonSecurityLog, AzureNetworkAnalytics_CL
| where TimeGenerated >= ago(7d)
| where DeviceVendor =~ "Palo Alto Networks" or DeviceProduct =~ "PAN-OS"
| where Activity has_any ("auth-bypass", "session-hijack", "invalid-cookie", "auth-failure") or RequestURL has_any ("/php/login.php", "/api/?type=keygen", "/global-protect", "/ssl-vpn") or AdditionalExtensions has_any ("cookie", "bypass", "forged")
| extend SrcIP = coalesce(SourceIP, SourceAddress)
| summarize AttemptCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), UniqueURIs = dcount(RequestURL), UniqueUsers = dcount(SourceUserName) by SrcIP, DeviceProduct, Activity, bin(TimeGenerated, 5m)
| where AttemptCount > 3
| extend RiskScore = case(AttemptCount > 20, "Critical", AttemptCount > 10, "High", "Medium")
| project-reorder TimeGenerated, SrcIP, Activity, AttemptCount, UniqueURIs, UniqueUsers, RiskScore, FirstSeen, LastSeen

index=network sourcetype IN (pan:traffic, pan:system, pan:threat, pan:log) vendor="Palo Alto Networks"
| eval uri=coalesce(url, uri_path, request)
| eval auth_event=if(match(lower(signature), "auth|bypass|cookie|session|invalid-token"), 1, 0)
| eval suspicious_uri=if(match(lower(uri), "/php/login\.php|/api/\?type=keygen|/global-protect|/ssl-vpn"), 1, 0)
| where auth_event=1 OR suspicious_uri=1
| bucket _time span=5m
| stats count as attempt_count, dc(uri) as unique_uris, dc(src_user) as unique_users, values(uri) as uris, values(signature) as signatures by _time, src_ip, dest_ip, action
| where attempt_count > 3
| eval risk=case(attempt_count > 20, "Critical", attempt_count > 10, "High", true(), "Medium")
| table _time, src_ip, dest_ip, attempt_count, unique_uris, unique_users, uris, signatures, action, risk
| sort -attempt_count

sequence by source.ip with maxspan=10m
  [network where event.dataset == "panw.panos" and
   (http.request.uri.path : ("/php/login.php", "/api/*type=keygen*", "/global-protect*", "/ssl-vpn*") or
    event.action : ("auth-bypass", "session-invalid", "cookie-forged", "invalid-cookie") or
    panw.panos.sub_type : ("auth", "system") and panw.panos.description : ("*cookie*", "*bypass*", "*invalid*")) and
   event.outcome == "failure"
  ] with runs=3

SELECT sourceip, destinationip, username, url, category, eventcount, starttime, endtime
FROM events
WHERE devicetype = 'Palo Alto PA Series' OR logsourcetypename(devicetype) ILIKE '%palo alto%'
AND LAST 7 DAYS
AND (
  LOWER(url) SIMILAR TO '.*(/php/login\.php|/api/\?type=keygen|/global-protect|/ssl-vpn).*'
  OR LOWER(category) SIMILAR TO '.*(auth|bypass|cookie|session|invalid).*'
  OR LOWER(eventdescription) SIMILAR TO '.*(cookie|bypass|forged|invalid token|auth failure).*'
)
GROUP BY sourceip, destinationip, username, url, category, DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm')
HAVING eventcount > 3
ORDER BY eventcount DESC

_sourceCategory=network/paloalto OR _sourceCategory=firewall/panw
| parse "src_ip=*" as src_ip nodrop
| parse "url=*" as url nodrop
| parse "action=*" as action nodrop
| parse "category=*" as category nodrop
| parse "desc=*" as desc nodrop
| where url matches "*/php/login.php*" OR url matches "*/api/?type=keygen*" OR url matches "*/global-protect*" OR url matches "*/ssl-vpn*"
  OR toLowerCase(category) matches "*auth*bypass*" OR toLowerCase(category) matches "*cookie*"
  OR toLowerCase(desc) matches "*cookie*" OR toLowerCase(desc) matches "*bypass*" OR toLowerCase(desc) matches "*invalid token*"
| timeslice 5m
| count as attempt_count, count_distinct(url) as unique_uris by _timeslice, src_ip, action
| where attempt_count > 3
| if(attempt_count > 20, "Critical", if(attempt_count > 10, "High", "Medium")) as risk_level
| sort by attempt_count desc

rule cve_2026_0257_panw_auth_bypass {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects CVE-2026-0257 PAN-OS authentication bypass via cookie manipulation"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://security.paloaltonetworks.com/CVE-2026-0257"

  events:
    $e.metadata.vendor_name = "Palo Alto Networks" nocase
    (
      $e.network.http.request_url = /\/(php\/login\.php|api\/\?type=keygen|global-protect|ssl-vpn)/i or
      $e.security_result.category_details = /auth.*bypass|bypass.*auth|cookie.*invalid|invalid.*cookie|session.*forged/i or
      $e.security_result.description = /cookie|bypass|forged|invalid.token|auth.failure/i
    )
    $e.security_result.action = "BLOCK" or $e.security_result.action = "DENY" or
    $e.metadata.event_type = "NETWORK_HTTP"

  match:
    $e.principal.ip over 5m

  outcome:
    $risk_score = max(
      if($e.security_result.action = "ALLOW" and $e.network.http.request_url = /login|keygen/i, 90, 0) +
      if($e.security_result.description = /bypass|cookie|forged/i, 30, 0)
    )

  condition:
    #e > 3 and $risk_score > 0
}

#event_simpleName IN ("NetworkConnectIP4", "NetworkConnectIP6", "HttpRequest", "ProcessRollup2")
| $vendor_name = "Palo Alto Networks"
| $uri = HttpPath
| $action = HttpMethod
| ($uri = "*/php/login.php*" OR $uri = "*/api/?type=keygen*" OR $uri = "*/global-protect*" OR $uri = "*/ssl-vpn*"
   OR HttpResponseCode IN ("401", "403") AND HttpReferrer = "*global-protect*"
   OR UserAgent = "*GlobalProtect*")
| groupby([RemoteAddressIP4, $uri, HttpResponseCode], function=count(aid, as=attempt_count), window=5m)
| $attempt_count > 3
| $risk = if($attempt_count > 20, "Critical", if($attempt_count > 10, "High", "Medium"))
| sort(attempt_count, order=desc)
| select([timestamp, RemoteAddressIP4, $uri, HttpResponseCode, attempt_count, $risk])