Palo Alto reports attempts to exploit a GlobalProtect VPN bypass on cookie-enabled firewalls

Exposure here is a configuration question before it is a patching question. Palo Alto limits the affected set to firewalls with a GlobalProtect portal or gateway where authentication override cookies are enabled and a specific certificate configuration exists ^[8]. On a portal, the test is whether the generate-cookie or accept-cookie option is checked on the Authentication tab of the agent configuration profile ^[9]. On a gateway it is the accept-cookie box alone, on the Authentication Override tab of the client settings profile ^[10]. The advisory text does not define the certificate configuration, and its FAQ entry on why the severity changed ends before an answer ^[8][3].

The first mitigation hints at what that configuration is. Palo Alto tells customers to generate a certificate exclusively for authentication override cookies, not to reuse the portal or gateway certificate, and not to share the new one with other features or users ^[14]. We think a shared certificate is the condition the advisory means, though that is an inference from the mitigation wording.

The scoring sends two signals. Palo Alto labels the severity HIGH, with CVSS-BT and CVSS-B both at 7.8 ^[1][2], so the threat-adjusted score sits 0.0 points above the base score ^[19]. The suggested urgency is HIGHEST ^[1]. The vector describes an attack over the network with low complexity, no privileges required and no user interaction ^[4]. A queue sorted on the number alone would schedule this as routine High work. The urgency field is what moves it up.

Hybrid Prisma Access deployments add a dependency. Palo Alto says every on-premises next-generation firewall in such a deployment must be upgraded to the fixed PAN-OS versions so that cookies stay compatible with the Prisma Access cloud environment ^[16]. A team that cannot move every component in one window has one documented route. A CLI setting disables strict cookie HMAC validation on upgraded firewalls, reverts them to legacy cookie behavior and prevents user authentication failures during the transition ^[17]. Palo Alto says the setting must be switched back on once every portal and gateway is fixed, to fully enforce the security enhancements ^[17]. We'd expect an upgraded firewall in that interim state to lack the new protection, since the advisory ties the enhancements to strict validation.

Sequencing follows from that. This week's work is the configuration check and, on any firewall with cookies enabled, one of the two mitigations, because Palo Alto ties the exploit attempts it has seen to unpatched devices without mitigations applied ^[11]. This quarter's work is the coordinated upgrade and the one-time login it forces ^[18]. A firewall that is mitigated now and upgraded later still owes the upgrade, and the phased route adds a second change to that quarter's list: switching strict HMAC validation back on ^[17].