VPN Apps (Palo Alto, Cisco, Pulse Secure and f5) - Session Cookie Vulnerability

Read this Article earlier today. Out of four vendors, only Palo Alto has issued a patch. Until the apps are patched, best defense appears to be two factor authentication.