--- title: Detecting CVE-2026-0265 at Scale: PAN-OS CAS... description: Bishop Fox published a detection tool and technical breakdown for CVE-2026-0265, a pre-authentication JWT signature bypass in PAN-OS and Panorama that is... canonical: https://daily.dev/posts/detecting-cve-2026-0265-at-scale-pan-os-cas-authentication-bypass-jzh2fzta8 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Detecting CVE-2026-0265 at Scale: PAN-OS CAS Authentication Bypass | daily.dev og:description: Bishop Fox published a detection tool and technical breakdown for CVE-2026-0265, a pre-authentication JWT signature bypass in PAN-OS and Panorama that is... og:url: https://daily.dev/posts/detecting-cve-2026-0265-at-scale-pan-os-cas-authentication-bypass-jzh2fzta8 og:image: https://api.daily.dev/og/posts/JZH2FztA8.png og:image:alt: Detecting CVE-2026-0265 at Scale: PAN-OS CAS Authentication Bypass og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Detecting CVE-2026-0265 at Scale: PAN-OS CAS Authentication Bypass **[Sliver C2 Documentation](https://daily.dev/sources/bishopfox)** · 10 min read · 0 upvotes · 0 comments ## Summary Bishop Fox published a detection tool and technical breakdown for CVE-2026-0265, a pre-authentication JWT signature bypass in PAN-OS and Panorama that is exploitable only when Cloud Authentication Service (CAS) is attached to an authentication profile. The root cause is algorithm confusion in pan_auth_verify, which lets an attacker present an HS256-signed token that gets HMAC-verified against a public RSA key the firewall trusts, allowing forgery of VPN or admin sessions on GlobalProtect portals and management interfaces. Their open-source script issues a single anonymous GET to /global-protect/prelogin.esp, reads the flag and an embedded JWT's PanOSversion claim, and checks it against the vendor's hotfix matrix to return a vulnerable/not-vulnerable verdict, short-circuiting SaaS-managed builds. Fixed versions are 10.2.18+, 11.1.15+, 11.2.12+, and 12.1.7+; detaching CAS or enabling Threat ID 510008 are interim workarounds. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is CVE-2026-0265 and how does the PAN-OS JWT authentication bypass work? CVE-2026-0265 is a pre-authentication JWT algorithm confusion vulnerability in PAN-OS and Panorama, reachable only when Cloud Authentication Service (CAS) is attached to an authentication profile. The flaw is in pan_auth_verify inside libpanmp_mp.so, which accepts alg=HS256 and computes an HMAC over the RSA public key CAS provides for RS256 verification, letting anyone who reads that public key forge a valid token for any trusted user. _Track emerging PAN-OS CVEs like this one on daily.dev before they hit your fleet._ ### How do I check if my PAN-OS GlobalProtect portal is vulnerable to CVE-2026-0265 without authenticating? Send a single anonymous GET request to /global-protect/prelogin.esp and inspect two fields: the tag, which reads 'yes' only when CAS is the configured auth method, and the embedded JWT inside the base64-encoded saml-request field, whose PanOSversion claim gives the authoritative firmware build. Compare that build against the vendor's per-base hotfix matrix (fixed at 10.2.18+, 11.1.15+, 11.2.12+, 12.1.7+) to get a vulnerable or not-vulnerable verdict. _Developers hardening exposed network appliances can follow disclosures like this on daily.dev._ ### Are cloud-managed (SaaS) PAN-OS deployments affected by CVE-2026-0265? No, cloud-managed PAN-OS builds are not affected by CVE-2026-0265 because they are patched independently through the cloud-managed deployment pipeline, per Palo Alto Networks' May 21, 2026 clarification. These SaaS builds can be identified by a trailing '.saas' suffix on the PanOSversion claim, such as 11.2.7-h9.saas, which short-circuits straight to a not-affected verdict. _Security teams triaging vendor advisories can keep tabs on clarifications like this via daily.dev._ ## Similar posts on daily.dev - [Check Point SmartConsole Authentication Bypass Is Under Active Attack, and a PoC Is Now Public](https://daily.dev/posts/check-point-smartconsole-authentication-bypass-is-under-active-attack-and-a-poc-is-now-public-gygbdb6p9) · Latest Hacking News · 0 upvotes · 0 comments - [Palo Alto Networks warns of firewall RCE zero-day exploited in attacks](https://daily.dev/posts/palo-alto-networks-warns-of-firewall-rce-zero-day-exploited-in-attacks-zo4m3vufc) · BleepingComputer · 3 upvotes · 0 comments - [One Port to Root: Weaponizing Check Point Management CVE-2026-93616](https://daily.dev/posts/one-port-to-root-weaponizing-check-point-management-cve-2026-93616-foy8qulzb) · Sliver C2 Documentation · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#jwt](https://daily.dev/tags/jwt) [View this post on daily.dev](https://daily.dev/posts/detecting-cve-2026-0265-at-scale-pan-os-cas-authentication-bypass-jzh2fzta8) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Detecting CVE-2026-0265 at Scale: PAN-OS CAS Authentication Bypass","url":"https://daily.dev/posts/detecting-cve-2026-0265-at-scale-pan-os-cas-authentication-bypass-jzh2fzta8","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/detecting-cve-2026-0265-at-scale-pan-os-cas-authentication-bypass-jzh2fzta8"},"datePublished":"2026-08-23T12:22:41.708Z","dateModified":"2026-08-23T12:49:45.616Z","description":"Bishop Fox published a detection tool and technical breakdown for CVE-2026-0265, a pre-authentication JWT signature bypass in PAN-OS and Panorama that is...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/33e86f86ac82f4c649ac926d0338bca9?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/33e86f86ac82f4c649ac926d0338bca9?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Sliver C2 Documentation","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Sliver C2 Documentation","logo":"https://media.daily.dev/image/upload/logos/placeholder.jpg","url":"https://daily.dev/sources/bishopfox"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/detecting-cve-2026-0265-at-scale-pan-os-cas-authentication-bypass-jzh2fzta8","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,jwt","timeRequired":"PT10M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Sliver C2 Documentation","item":"https://daily.dev/sources/bishopfox"},{"@type":"ListItem","position":3,"name":"Detecting CVE-2026-0265 at Scale: PAN-OS CAS Authentication Bypass"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/detecting-cve-2026-0265-at-scale-pan-os-cas-authentication-bypass-jzh2fzta8#faq","mainEntity":[{"@type":"Question","name":"What is CVE-2026-0265 and how does the PAN-OS JWT authentication bypass work?","acceptedAnswer":{"@type":"Answer","text":"CVE-2026-0265 is a pre-authentication JWT algorithm confusion vulnerability in PAN-OS and Panorama, reachable only when Cloud Authentication Service (CAS) is attached to an authentication profile. The flaw is in pan_auth_verify inside libpanmp_mp.so, which accepts alg=HS256 and computes an HMAC over the RSA public key CAS provides for RS256 verification, letting anyone who reads that public key forge a valid token for any trusted user. Track emerging PAN-OS CVEs like this one on daily.dev before they hit your fleet."}},{"@type":"Question","name":"How do I check if my PAN-OS GlobalProtect portal is vulnerable to CVE-2026-0265 without authenticating?","acceptedAnswer":{"@type":"Answer","text":"Send a single anonymous GET request to /global-protect/prelogin.esp and inspect two fields: the tag, which reads 'yes' only when CAS is the configured auth method, and the embedded JWT inside the base64-encoded saml-request field, whose PanOSversion claim gives the authoritative firmware build. Compare that build against the vendor's per-base hotfix matrix (fixed at 10.2.18+, 11.1.15+, 11.2.12+, 12.1.7+) to get a vulnerable or not-vulnerable verdict. Developers hardening exposed network appliances can follow disclosures like this on daily.dev."}},{"@type":"Question","name":"Are cloud-managed (SaaS) PAN-OS deployments affected by CVE-2026-0265?","acceptedAnswer":{"@type":"Answer","text":"No, cloud-managed PAN-OS builds are not affected by CVE-2026-0265 because they are patched independently through the cloud-managed deployment pipeline, per Palo Alto Networks' May 21, 2026 clarification. These SaaS builds can be identified by a trailing '.saas' suffix on the PanOSversion claim, such as 11.2.7-h9.saas, which short-circuits straight to a not-affected verdict. Security teams triaging vendor advisories can keep tabs on clarifications like this via daily.dev."}}]} ```