CVE-2026-0257 check | Discovery Lab

CVE-2026-0257

Check GlobalProtect against the advisory.

This issue affects firewalls with a GlobalProtect portal or gateway configured when authentication override cookies are enabled and a specific certificate configuration exists. Panorama and Cloud NGFW are not impacted.

How to tell

On the portal, the advisory says to check Generate cookie for authentication override or Accept cookie for authentication override. On the gateway, check Accept cookie for authentication override.
The advisory says the issue also depends on a specific certificate configuration. Its mitigation is a certificate used only for those cookies. Do not reuse the portal or gateway certificate.
Unit 42 says to open the management address from an external browser on ports 4443 and 3879. A connection means the management interface is exposed.

Start the exposure check