Palo Alto, Exchange OWA, and the exposure numbers that matter

The Palo Alto GlobalProtect bypass — and why exposure counts can mislead

In May, Palo Alto disclosed CVE-2026-0257, an authentication bypass in the GlobalProtect portal and gateway of PAN-OS. Palo Alto lists the exploit maturity as attacked; Rapid7 first observed exploitation on 17 May, and CISA added it to KEV with a 1 June federal remediation date. The issue sits in GlobalProtect's authentication override cookie feature. If authentication override is enabled and the cookie certificate is reused with the public HTTPS service, an attacker can obtain the public key from the TLS certificate and create a cookie PAN-OS may accept as proof of authentication.

What we verified

We extracted the vulnerable gpsvc binary from a PAN-OS 11.2.10-h6 lab instance and reviewed the cookie handling path. Rapid7 has already published the public-key forgery mechanism. Our lab and binary review add a narrower point: configuration and backend path matter, and exposure counts alone do not tell you who is exploitable.

# public-key forgery path described by Rapid7 and reviewed in our lab
plaintext  = "user;domain;os;host-id;timestamp;client-ip"
ciphertext = RSA_2048_PKCS1v15( cert_PUBLIC_key, plaintext )   # public key from TLS cert
cookie     = base64( ciphertext )
# root flaw: public-key ENCRYPTION used as if it proved authenticity.
# anyone can encrypt with a public key — authenticity needs a signature or MAC.

Exchange OWA: "mitigated" is not "fixed"

Also in May: CVE-2026-42897, a cross-site-scripting vulnerability in on-premises Exchange Server's Outlook Web Access, exploited in the wild with no permanent patch as of writing. The attack begins entirely outside your org — an attacker sends a crafted email; when a victim opens it in OWA, attacker JavaScript can run in the victim's authenticated browser context. That can allow actions inside the mailbox session, such as reading mail or manipulating mailbox state. No initial credential or internal foothold is required.

What our Exchange reverse-engineering suggests

Microsoft has not publicly disclosed the exact injection point. We decompiled Exchange 2019 CU15 OWA assemblies (build 15.02.1748.010) and found an attachment-serving path that is consistent with the published vector and the mitigation side-effects. This is a candidate root cause, not a confirmed attribution to CVE-2026-42897.

The path runs through GetFileAttachment → AttachmentHandler.GetAttachmentStream → WriteResponseHeaders. In the build we reviewed, that path makes its HTML filtering and forced-download decisions narrowly — keyed on the attachment's declared content type — and its SVG-specific protection is conditional rather than universal. That combination leaves a plausible route for attacker-supplied attachment content to render in the OWA same origin, which fits the reported "crafted email → script in your OWA session" behaviour.

What the rest of the month looked like

For Australian leaders — this week

Each item is written so a CIO, CISO or Head of Risk can forward it straight to the accountable team. Mapped to ASD Essential Eight and APRA CPS 234 where those frameworks apply.

1. 01 Inventory every internet-facing GlobalProtect portal/gateway Confirm PAN-OS version and whether auth-override is on with a shared cert; patch to the fixed train. ASD E8 — Patch Applications · CISA KEV 1 Jun
2. 02 Prioritise confirmed auth-override deployments The highest-risk configuration is GlobalProtect with authentication override enabled and shared certificate use. Patch affected VM-Series, physical PAN-OS and Prisma Access versions per the advisory.
3. 03 Verify Exchange EEMS — and your IE-mode exposure Mitigation applied is not enough if users reach OWA via IE/Edge IE mode. Plan migration off on-prem OWA where possible. APRA CPS 234
4. 04 Retire end-of-life Exchange 2013 It is outside the supported 42897 advisory scope and should be treated as exposed legacy risk. ASD E8 — Patch Applications
5. 05 Audit your edge identity appliances Patch the May Fortinet criticals and equivalents; review whether management and API interfaces are reachable from untrusted networks.

Australian exposure — measured snapshot

The story here is the measurement discipline, not precision to the last host. The broad GlobalProtect title query returns 8,382 AU results, while the stricter 443/login.esp query returns 119. · Method & limits: source = passive Shodan aggregate counts, AU scope; exposure ≠ exploitable; we did not classify PAN-OS build versions or authentication-override certificate configuration in this snapshot; Exchange version split is approximate and should be read as a point-in-time estimate.