Bishop Fox published a detection tool and technical breakdown for CVE-2026-0265, a pre-authentication JWT signature bypass in PAN-OS and Panorama that is exploitable only when Cloud Authentication Service (CAS) is attached to an authentication profile. The root cause is algorithm confusion in pan_auth_verify, which lets an attacker present an HS256-signed token that gets HMAC-verified against a public RSA key the firewall trusts, allowing forgery of VPN or admin sessions on GlobalProtect portals and management interfaces. Their open-source script issues a single anonymous GET to /global-protect/prelogin.esp, reads the <cas-auth> flag and an embedded JWT's PanOSversion claim, and checks it against the vendor's hotfix matrix to return a vulnerable/not-vulnerable verdict, short-circuiting SaaS-managed builds. Fixed versions are 10.2.18+, 11.1.15+, 11.2.12+, and 12.1.7+; detaching CAS or enabling Threat ID 510008 are interim workarounds.
Table of contents
SummaryWhat Defenders Should Do Right NowThe Bug in One ParagraphTwo Surfaces, One URLA Two-Factor Verdict From a Single RequestResolving the verdict against the advisoryWhat Else The Prelogin Response RevealsWhen The Assessment AbstainsConclusionQuestions this post answers
What is CVE-2026-0265 and how does the PAN-OS JWT authentication bypass work?
CVE-2026-0265 is a pre-authentication JWT algorithm confusion vulnerability in PAN-OS and Panorama, reachable only when Cloud Authentication Service (CAS) is attached to an authentication profile. The flaw is in pan_auth_verify inside libpanmp_mp.so, which accepts alg=HS256 and computes an HMAC over the RSA public key CAS provides for RS256 verification, letting anyone who reads that public key forge a valid token for any trusted user. Track emerging PAN-OS CVEs like this one on daily.dev before they hit your fleet.
How do I check if my PAN-OS GlobalProtect portal is vulnerable to CVE-2026-0265 without authenticating?
Send a single anonymous GET request to /global-protect/prelogin.esp and inspect two fields: the <cas-auth> tag, which reads 'yes' only when CAS is the configured auth method, and the embedded JWT inside the base64-encoded saml-request field, whose PanOSversion claim gives the authoritative firmware build. Compare that build against the vendor's per-base hotfix matrix (fixed at 10.2.18+, 11.1.15+, 11.2.12+, 12.1.7+) to get a vulnerable or not-vulnerable verdict. Developers hardening exposed network appliances can follow disclosures like this on daily.dev.
Are cloud-managed (SaaS) PAN-OS deployments affected by CVE-2026-0265?
No, cloud-managed PAN-OS builds are not affected by CVE-2026-0265 because they are patched independently through the cloud-managed deployment pipeline, per Palo Alto Networks' May 21, 2026 clarification. These SaaS builds can be identified by a trailing '.saas' suffix on the PanOSversion claim, such as 11.2.7-h9.saas, which short-circuits straight to a not-affected verdict. Security teams triaging vendor advisories can keep tabs on clarifications like this via daily.dev.