An authentication bypass vulnerability in Palo Alto Networks PAN-OS® software enables an unauthenticated…

#!/usr/bin/env python3
# panos_cve_2026_0265_check.py
# Safe external checker for the GlobalProtect portal surface of CVE-2026-0265.
# Output: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN, 3=usage

import sys
import re
import json
import base64
import requests
import urllib3
from xml.etree import ElementTree as ET

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

FIXED = {
    '10.2.7': '10.2.7-h34',
    '10.2.10': '10.2.10-h36',
    '10.2.13': '10.2.13-h21',
    '10.2.16': '10.2.16-h7',
    '10.2.18': '10.2.18-h6',
    '11.1.4': '11.1.4-h33',
    '11.1.6': '11.1.6-h32',
    '11.1.7': '11.1.7-h6',
    '11.1.10': '11.1.10-h25',
    '11.1.13': '11.1.13-h5',
    '11.1.15': '11.1.15',
    '11.2.4': '11.2.4-h17',
    '11.2.7': '11.2.7-h13',
    '11.2.10': '11.2.10-h6',
    '11.2.12': '11.2.12',
    '12.1.4': '12.1.4-h5',
    '12.1.7': '12.1.7',
}

BROWSER_UA = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36'


def b64url_decode(data: str) -> bytes:
    data = data.strip()
    pad = '=' * ((4 - len(data) % 4) % 4)
    return base64.urlsafe_b64decode(data + pad)


def parse_version(v: str):
    vs = v.strip()
    saas = vs.endswith('.saas')
    if saas:
        vs = vs[:-5]
    m = re.fullmatch(r'(\d+)\.(\d+)\.(\d+)(?:-h(\d+))?', vs)
    if not m:
        return None
    major, minor, patch, hotfix = m.groups()
    return (int(major), int(minor), int(patch), int(hotfix or 0), saas)


def compare_versions(a: str, b: str):
    pa = parse_version(a)
    pb = parse_version(b)
    if pa is None or pb is None:
        raise ValueError('unparseable version')
    ta = pa[:4]
    tb = pb[:4]
    if ta < tb:
        return -1
    if ta > tb:
        return 1
    return 0


def fixed_for(version: str):
    pv = parse_version(version)
    if pv is None:
        return None
    base = f'{pv[0]}.{pv[1]}.{pv[2]}'
    return FIXED.get(base)


def extract_text(elem, name):
    found = elem.find('.//' + name)
    if found is None or found.text is None:
        return ''
    return found.text.strip()


def get_version_from_saml_request(saml_request_b64: str):
    html = base64.b64decode(saml_request_b64)
    text = html.decode('utf-8', errors='replace')
    m = re.search(r'name=["\']Token["\']\s+value=["\']([^"\']+)["\']', text, re.I)
    if not m:
        raise ValueError('Token not found in decoded saml-request')
    token = m.group(1)
    parts = token.split('.')
    if len(parts) < 2:
        raise ValueError('JWT format invalid')
    payload = json.loads(b64url_decode(parts[1]).decode('utf-8', errors='replace'))
    version = payload.get('PanOSversion') or payload.get('panosversion')
    if not version:
        raise ValueError('PanOSversion claim missing')
    return version


def main():
    if len(sys.argv) != 2:
        print('Usage: python3 panos_cve_2026_0265_check.py https://gp.example.com')
        sys.exit(3)

    target = sys.argv[1].strip()
    if not re.match(r'^https?://', target, re.I):
        target = 'https://' + target
    url = target.rstrip('/') + '/global-protect/prelogin.esp'

    try:
        r = requests.get(url, timeout=20, verify=False, headers={'User-Agent': BROWSER_UA})
    except Exception as e:
        print(f'UNKNOWN - request failed: {e}')
        sys.exit(2)

    if r.status_code != 200:
        print(f'UNKNOWN - HTTP {r.status_code}')
        sys.exit(2)

    body = r.text
    if 'Valid client certificate is required' in body:
        print('UNKNOWN - portal is mTLS-gated; external anonymous verdict not possible')
        sys.exit(2)

    try:
        root = ET.fromstring(body)
    except Exception as e:
        print(f'UNKNOWN - XML parse failed: {e}')
        sys.exit(2)

    cas_auth = extract_text(root, 'cas-auth').lower()
    if cas_auth == 'no':
        print('PATCHED - CAS not attached on this GlobalProtect portal; vulnerable code path not reachable')
        sys.exit(0)
    if cas_auth != 'yes':
        print('UNKNOWN - could not determine CAS attachment or target is not a GlobalProtect portal')
        sys.exit(2)

    saml_request = extract_text(root, 'saml-request')
    if not saml_request:
        print('UNKNOWN - CAS appears enabled but saml-request token was not present')
        sys.exit(2)

    try:
        version = get_version_from_saml_request(saml_request)
    except Exception as e:
        print(f'UNKNOWN - failed to recover PAN-OS version: {e}')
        sys.exit(2)

    parsed = parse_version(version)
    if parsed is None:
        print(f'UNKNOWN - unparseable PAN-OS version: {version}')
        sys.exit(2)

    if parsed[4]:
        print(f'PATCHED - cloud-managed .saas build not affected ({version})')
        sys.exit(0)

    fixed = fixed_for(version)
    if not fixed:
        print(f'UNKNOWN - PAN-OS base not in local fixed-version map ({version})')
        sys.exit(2)

    try:
        cmpv = compare_versions(version, fixed)
    except Exception as e:
        print(f'UNKNOWN - version comparison failed: {e}')
        sys.exit(2)

    if cmpv < 0:
        print(f'VULNERABLE - CAS attached and {version} is below fixed build {fixed}')
        sys.exit(1)
    else:
        print(f'PATCHED - CAS attached and {version} is at or above fixed build {fixed}')
        sys.exit(0)


if __name__ == '__main__':
    main()