Detect Palo Alto Networks PAN-OS Authentication Bypass (CVE-2026-0257) in Elastic Security
Detects exploitation attempts of CVE-2026-0257, an authentication bypass vulnerability in Palo Alto Networks PAN-OS caused by improper reliance on cookies for security decisions (CWE-565). An attacker can manipulate session cookies to bypass authentication controls on PAN-OS management interfaces or VPN endpoints. This vulnerability is confirmed exploited in the wild (CISA KEV).
MITRE ATT&CK
Elastic Detection Query
sequence by source.ip with maxspan=10m
[network where event.dataset == "panw.panos" and
(http.request.uri.path : ("/php/login.php", "/api/*type=keygen*", "/global-protect*", "/ssl-vpn*") or
event.action : ("auth-bypass", "session-invalid", "cookie-forged", "invalid-cookie") or
panw.panos.sub_type : ("auth", "system") and panw.panos.description : ("*cookie*", "*bypass*", "*invalid*")) and
event.outcome == "failure"
] with runs=3EQL sequence rule detecting three or more authentication failures or suspicious cookie-related events from the same source IP against PAN-OS endpoints within a 10-minute window.
Data Sources
Required Tables
False Positives & Tuning
- Roaming VPN users generating repeated auth failures due to network transitions
- Automated scripts performing repeated API authentication for legitimate integrations
- Expired certificates on PAN-OS API clients causing authentication loops
- Vulnerability scanners performing authenticated checks against PAN-OS
Other platforms for CVE-2026-0257
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1PAN-OS Cookie Bypass Authentication Simulation
Expected signal: PAN-OS auth logs should show repeated authentication failure events with unusual cookie headers; HTTP access logs should capture the source IP, URI, and malformed cookie values; network monitoring should detect the rapid sequential requests to multiple PAN-OS endpoints.
- Test 2PAN-OS Management Interface Enumeration
Expected signal: Network logs should capture sequential HTTP GET/POST requests to multiple PAN-OS management URIs from single source; firewall logs should record the connection attempts and response codes; IDS/IPS should flag the rapid enumeration pattern.
- Test 3Session Token Forgery Attempt Against PAN-OS
Expected signal: PAN-OS authentication daemon logs should show multiple failed auth attempts with varying PHPSESSID values and non-standard headers (X-PAN-AUTHCHECK); SIEM should capture the pattern of sequential attempts with different cookie values from single source IP.
Response Playbook
Triage
- Identify the source IP(s) triggering authentication bypass indicators and cross-reference against known internal IP ranges, VPN gateways, and authorized management hosts to determine if the traffic is expected.
- Review PAN-OS system logs and auth logs on the affected device for the timeframe to confirm whether any authentication was actually successful following the suspicious attempts — a successful login after bypass attempts is an immediate escalation trigger.
- Determine the targeted interface: management plane (port 443/HTTPS), GlobalProtect VPN portal, or API endpoint — each has different blast radius implications and should inform the urgency of containment.
- Check CISA KEV remediation deadlines and confirm patch status of all PAN-OS devices in inventory against the vendor advisory at https://security.paloaltonetworks.com/CVE-2026-0257.
- Query threat intelligence platforms for the offending source IPs to determine if they are associated with known threat actors, Tor exit nodes, or previously seen attack infrastructure.
Containment
- Immediately restrict management plane access to PAN-OS devices by enforcing management interface ACLs to allow only trusted administrator IP ranges, and disable public-facing management access if not operationally required.
- Rotate all PAN-OS administrator credentials and invalidate active sessions on affected devices; revoke and reissue API keys used for automation to prevent use of any potentially compromised session tokens.
- If exploitation is confirmed, isolate the affected PAN-OS device from the network by placing it behind an additional firewall segment or taking it offline pending patching, and failover VPN and firewall functions to a clean standby unit if available.
Evidence Collection
- Export PAN-OS system logs, auth logs, and traffic logs for the 48-hour window surrounding the first detection event, preserving them to immutable storage for forensic analysis.
- Capture and preserve any HTTP session data, cookie values, and request headers associated with the suspicious authentication events from proxy or web application firewall logs to support cookie forgery analysis.
- Document the full list of sessions that were active on the affected PAN-OS device at the time of exploitation, including associated source IPs, usernames, and session durations, to scope any unauthorized access.
Escalation Criteria
- !Escalate immediately to incident response if any authentication bypass attempt results in a successful login — check for POST-authentication activity such as configuration changes, policy modifications, or credential harvesting.
- !Escalate if the source IP is confirmed as external threat infrastructure, if multiple PAN-OS devices show simultaneous exploitation attempts, or if lateral movement from the PAN-OS device into protected network segments is detected.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
PAN-OS /var/log/pan/authd.log entries showing authentication events with unusual or malformed cookie values - >
HTTP access logs on the management interface showing requests to /php/login.php, /api/?type=keygen, or /global-protect with anomalous headers or cookie fields - >
PAN-OS configuration audit trail (config log) showing any configuration changes made after the bypass window — indicates successful exploitation and post-auth activity - >
NetFlow or session table exports showing the source IP establishing sessions to protected internal segments originating from the PAN-OS device context
Tuning Guidance
Reduce false positives by baselining legitimate PAN-OS management IPs and VPN authentication volumes per environment and adding them to an allowlist. Increase detection confidence by requiring both a suspicious URI pattern AND an anomalous HTTP response code (e.g., 200 following a sequence of 401s) rather than alerting on either alone. For environments with large GlobalProtect deployments, raise the attempt_count threshold (currently 3) to match normal peak authentication volumes. Consider correlating with threat intelligence feeds to prioritize alerts from external IPs and deprioritize internal management traffic.
Hunting Queries
Threat hunt for successful authentications to PAN-OS management and API endpoints — identifies cases where a bypass may have succeeded rather than been blocked, particularly important given KEV exploitation status.
CommonSecurityLog
| where TimeGenerated >= ago(30d)
| where DeviceVendor =~ "Palo Alto Networks"
| where AdditionalExtensions has_any ("cookie", "token", "session") and Activity has_any ("auth", "login", "keygen")
| where EventOutcome =~ "success"
| summarize SuccessfulLogins = count(), UniqueIPs = dcount(SourceIP) by DestinationIP, SourceUserName, bin(TimeGenerated, 1h)
| where SuccessfulLogins > 0
| order by SuccessfulLogins descindex=network sourcetype=pan:system OR sourcetype=pan:log vendor="Palo Alto Networks"
| search (url="*/php/login*" OR url="*/api/?type=keygen*") AND action="allow"
| stats count as success_count, values(src_ip) as source_ips by dest_ip, src_user, date_hour
| where success_count > 0
| sort -success_countAtomic Red Team Tests
Simulates CVE-2026-0257 exploitation by sending crafted HTTP requests to PAN-OS management interface with manipulated cookie values to test authentication bypass detection coverage.
Command
# LAB ENVIRONMENT ONLY — requires isolated PAN-OS test instance
TARGET="https://panw-lab.internal"
# Test 1: Manipulated cookie to management login
curl -sk -X POST "${TARGET}/php/login.php" \
-H "Cookie: PHPSESSID=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA; ROLE=admin" \
-H "Content-Type: application/x-www-form-urlencoded" \
-d "prot=https:&server=&authType=login&challengeCookie=&user=admin&passwd=bogus&challengePwd=&ok=Log+In"
# Test 2: API keygen with forged session
curl -sk -X GET "${TARGET}/api/?type=keygen&user=admin&password=bogus" \
-H "Cookie: pan_reqs=1; PHPSESSID=FORGED_SESSION_VALUE"
# Test 3: GlobalProtect portal probe
curl -sk -X POST "${TARGET}/global-protect/login.esp" \
-H "Cookie: GPCS=CRAFTED_COOKIE" \
-d "prot=https:&ok=Sign+In&inputStr="Cleanup
No cleanup required — requests are stateless and do not modify target configuration in a properly isolated lab environment.Expected Telemetry
PAN-OS auth logs should show repeated authentication failure events with unusual cookie headers; HTTP access logs should capture the source IP, URI, and malformed cookie values; network monitoring should detect the rapid sequential requests to multiple PAN-OS endpoints.
Expected Detection
Detection rules should fire on 3+ authentication attempts within 5 minutes from the same source IP targeting PAN-OS login URIs with anomalous cookie patterns.
Simulates pre-exploitation reconnaissance of PAN-OS management and VPN interfaces to test detection of scanning activity that precedes CVE-2026-0257 exploitation.
Command
# LAB ENVIRONMENT ONLY
TARGET_HOST="panw-lab.internal"
# Probe common PAN-OS endpoints
for ENDPOINT in "/php/login.php" "/api/?type=version" "/global-protect/login.esp" "/ssl-vpn/login.html" "/php/utils/GuiFramework.php"; do
echo "[*] Probing ${ENDPOINT}"
curl -sk -o /dev/null -w "%{http_code} %{url_effective}\n" "https://${TARGET_HOST}${ENDPOINT}"
sleep 1
done
# Test API endpoint without authentication
curl -sk "https://${TARGET_HOST}/api/?type=keygen&user=test&password=test" | grep -o '<response status="[^"]*"'Cleanup
No persistent changes — HTTP probes are read-only. Clear local curl cache if applicable.Expected Telemetry
Network logs should capture sequential HTTP GET/POST requests to multiple PAN-OS management URIs from single source; firewall logs should record the connection attempts and response codes; IDS/IPS should flag the rapid enumeration pattern.
Expected Detection
Detection rules targeting unique URI count from a single IP or rapid sequential access to PAN-OS management endpoints should trigger within the enumeration window.
Tests detection of forged session tokens crafted to exploit CWE-565 (reliance on cookies for security decisions) in PAN-OS, simulating the core mechanism of CVE-2026-0257.
Command
# LAB ENVIRONMENT ONLY — requires PAN-OS test instance with network isolation
TARGET="https://panw-lab.internal"
# Generate a set of crafted cookie values mimicking PAN-OS session formats
for i in $(seq 1 10); do
FAKE_COOKIE=$(python3 -c "import random, string; print(''.join(random.choices(string.ascii_uppercase + string.digits, k=40)))")
curl -sk -X POST "${TARGET}/php/login.php" \
-H "Cookie: PHPSESSID=${FAKE_COOKIE}; sessionToken=${FAKE_COOKIE}; isAdmin=true" \
-H "X-PAN-AUTHCHECK: off" \
-d "prot=https:&server=&authType=login&user=admin&passwd=&ok=Log+In" \
-w " HTTP:%{http_code}\n" -o /dev/null
sleep 0.5
doneCleanup
No changes to target system. Remove any local log files capturing response data: rm -f /tmp/panw_test_*.logExpected Telemetry
PAN-OS authentication daemon logs should show multiple failed auth attempts with varying PHPSESSID values and non-standard headers (X-PAN-AUTHCHECK); SIEM should capture the pattern of sequential attempts with different cookie values from single source IP.
Expected Detection
Detections based on repeated auth failures with anomalous cookie patterns and custom headers should trigger; the rapid cadence (10 attempts in 5 seconds) should exceed the count threshold in all provided detection queries.