--- title: "Detecting CVE-2026-0265 at Scale: PAN-OS CAS Authentication Bypass" url: https://daily.dev/posts/detecting-cve-2026-0265-at-scale-pan-os-cas-authentication-bypass-jzh2fzta8 source_url: https://bishopfox.com/blog/detecting-cve-2026-0265-at-scale-pan-os-cas-authentication-bypass type: article source: "Sliver C2 Documentation" published: 2026-08-23T12:22:41.708Z updated: 2026-08-23T12:49:45.616Z tags: ["security", "jwt"] reading_time: 10 upvotes: 0 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Detecting CVE-2026-0265 at Scale: PAN-OS CAS Authentication Bypass **[Sliver C2 Documentation](https://daily.dev/sources/bishopfox)** · 10 min read · 0 upvotes · 0 comments ## Summary Bishop Fox published a detection tool and technical breakdown for CVE-2026-0265, a pre-authentication JWT signature bypass in PAN-OS and Panorama that is exploitable only when Cloud Authentication Service (CAS) is attached to an authentication profile. The root cause is algorithm confusion in pan_auth_verify, which lets an attacker present an HS256-signed token that gets HMAC-verified against a public RSA key the firewall trusts, allowing forgery of VPN or admin sessions on GlobalProtect portals and management interfaces. Their open-source script issues a single anonymous GET to /global-protect/prelogin.esp, reads the flag and an embedded JWT's PanOSversion claim, and checks it against the vendor's hotfix matrix to return a vulnerable/not-vulnerable verdict, short-circuiting SaaS-managed builds. Fixed versions are 10.2.18+, 11.1.15+, 11.2.12+, and 12.1.7+; detaching CAS or enabling Threat ID 510008 are interim workarounds. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is CVE-2026-0265 and how does the PAN-OS JWT authentication bypass work? CVE-2026-0265 is a pre-authentication JWT algorithm confusion vulnerability in PAN-OS and Panorama, reachable only when Cloud Authentication Service (CAS) is attached to an authentication profile. The flaw is in pan_auth_verify inside libpanmp_mp.so, which accepts alg=HS256 and computes an HMAC over the RSA public key CAS provides for RS256 verification, letting anyone who reads that public key forge a valid token for any trusted user. _Track emerging PAN-OS CVEs like this one on daily.dev before they hit your fleet._ ### How do I check if my PAN-OS GlobalProtect portal is vulnerable to CVE-2026-0265 without authenticating? Send a single anonymous GET request to /global-protect/prelogin.esp and inspect two fields: the tag, which reads 'yes' only when CAS is the configured auth method, and the embedded JWT inside the base64-encoded saml-request field, whose PanOSversion claim gives the authoritative firmware build. Compare that build against the vendor's per-base hotfix matrix (fixed at 10.2.18+, 11.1.15+, 11.2.12+, 12.1.7+) to get a vulnerable or not-vulnerable verdict. _Developers hardening exposed network appliances can follow disclosures like this on daily.dev._ ### Are cloud-managed (SaaS) PAN-OS deployments affected by CVE-2026-0265? No, cloud-managed PAN-OS builds are not affected by CVE-2026-0265 because they are patched independently through the cloud-managed deployment pipeline, per Palo Alto Networks' May 21, 2026 clarification. These SaaS builds can be identified by a trailing '.saas' suffix on the PanOSversion claim, such as 11.2.7-h9.saas, which short-circuits straight to a not-affected verdict. _Security teams triaging vendor advisories can keep tabs on clarifications like this via daily.dev._ --- Tags: [#security](https://daily.dev/tags/security), [#jwt](https://daily.dev/tags/jwt) [View this post on daily.dev](https://daily.dev/posts/detecting-cve-2026-0265-at-scale-pan-os-cas-authentication-bypass-jzh2fzta8)