Hunting for CVE-2026-0257: GlobalProtect Auth Bypass Indicators

Team,

With the news dropping about CVE-2026-0257 being actively exploited, I wanted to start a thread specifically on detection and IoCs. We know Palo Alto is rating this a CVSS 7.8, but let's be real—an auth bypass on a VPN gateway is basically a "reset button" for your perimeter security if exposed.

The flaw impacts PAN-OS and Prisma Access, specifically allowing unauthenticated actors to establish VPN connections. If you have GlobalProtect listening on the internet, assume you are a target.

I've whipped up a quick KQL query for Sentinel/SIEM to hunt for successful VPN authentications that might lack typical pre-auth steps or originate from unusual geo-locations. Since this is a bypass, we might be looking for successful tunnel-established events without corresponding auth-success logs in the same session, or perhaps sessions from unknown user agents.

let CommonUserAgents = datatable(UserAgent:string)["PAN GlobalProtect", "OpenConnect", "AnyConnect"];
PaloAltoNetworksFLC
| where LogType =~ "SYSTEM"
| where Subtype =~ "vpn"
| where Action =~ "tunnel-up"
| where not(UserAgent has_any (CommonUserAgents))
| project TimeGenerated, SourceIP, User, UserAgent, SerialNumber
| order by TimeGenerated desc

Has anyone captured the specific packet structure or unique headers associated with the exploitation attempts yet? I'm curious if the bypass leaves a fingerprint in the SSL handshake or initial HTTP POST.