Point hosts at PAN-OS GlobalProtect and flag CVE-2026-0257 (auth bypass) by version, then confirm with an unauthenticated GET. Non-destructive. CISA KEV.
Opens a protected endpoint without credentials. Advisory
Detect
Fingerprints PAN-OS and flags CVE-2026-0257 by version.
Report
Counts checked, product, affected, and confirmed.
Targets
Hosts, IPs, or URLs, one per line. Empty input uses localhost.
Overview
This workflow finds Palo Alto Networks PAN-OS GlobalProtect and sorts each host by whether its version falls in the CVE-2026-0257 range. GlobalProtect is the VPN portal. CVE-2026-0257 is authentication bypass on PAN-OS that lets a caller reach a protected endpoint without credentials. CISA put it on KEV because the exploit was public and used. A forgotten 10.2 box on a lab VLAN still answers the same portal you already know. Give it hostnames, IP addresses, or URLs you are authorised to test. The workflow fingerprints the product from the public page (title match on GlobalProtect), reads the version from /login with a fallback to the root body, and compares that number to the range table in the graph. Every host comes back affected or not, so a fleet advisory becomes an evidenced list for exposure management. CVE-2026-0257 is on CISA KEV (known exploited). Version flag is first. Hosts in range get a second node that opens a protected endpoint without credentials. It does not log in, dump secrets, or write files.
Run it on a schedule when the estate changes. New hosts and delayed patch windows are the reason the same check is worth more the second week than the first.
Pipeline
Read the target list. Hosts, URLs, or ranges, one per line, become the scope.
Fingerprint each host as Palo Alto Networks PAN-OS GlobalProtect from the public page title, then GET /login and parse the version. A host counts as affected only when the fingerprint matches and the version is inside the encoded range.
Confirm only those flagged hosts by opening a protected endpoint without credentials.
Collect the per-host rows: product match, version, affected flag, confirmed flag, and any fetch error.
Emit the summary counts: hosts checked, product hits, affected, confirmed, and errors.
Inputs
Target list. Hostnames, IP addresses, CIDR ranges, or URLs, one per line. JSONL with a url field also works. Point it at scope you are authorised to test. Fingerprint is read-only GET. Confirm opens a protected endpoint without credentials, and only after the version flag.
Outputs
results.jsonl. One row per host: URL, whether Palo Alto Networks PAN-OS GlobalProtect was detected, the version read, the affected flag, and whether the no-credential confirm succeeded.
summary.json. Counts across the list: targets, product hits, affected, and errors.
Integrations
HTTP. Unauthenticated GET to the product root, /login, and (on flagged hosts only) a protected endpoint.
Sample output
The records below are illustrative and do not come from a real run. They show one Palo Alto Networks PAN-OS GlobalProtect host inside the CVE-2026-0257 range, one patched host, and one host that is not the product.
Which Palo Alto Networks PAN-OS GlobalProtect versions does this flag?
every build before 10.2.7, and 10.2.8 through 11.2.10. 10.2.7 on that point release, and 11.2.11 and later on the 10.2.8+ train is the floor the graph treats as not affected. The compare uses the version the product itself served.
Does a flagged host mean CVE-2026-0257 was exploited?
No. A flagged row is patch-lag against the range table. Confirm only tries to open a protected endpoint without credentials. Treat a confirmed row as evidence that endpoint still answers, not as proof someone already used it.
Is this check safe on production?
Yes. Fingerprint is read-only GET. Confirm opens a protected endpoint without credentials, only on hosts already in range. It does not log in, dump secrets, or write files.
Does the check need credentials?
No. It fingerprints the public page and reads /login the way an external scanner would. Confirm also sends no credentials.
What is CVE-2026-0257?
Authentication bypass in PAN-OS GlobalProtect. CISA listed it on KEV after public exploit and confirmed use. This workflow flags by version, then confirms by opening a protected endpoint without credentials.