Palo Alto Networks patched an authentication bypass in its GlobalProtect VPN on May 13. Five months later, the company's own threat intelligence unit says ransomware groups are exploiting that bug to walk into corporate networks, and that it has been investigating related intrusions since early June. In one case it describes, the attackers went on to take over the virtualization layer and steal domain credentials.

The flaw is CVE-2026-0257. In an updated threat brief on October 19, Palo Alto's Unit 42 named the Qilin and Inc ransomware operations as exploiting it, according to Help Net Security. Any organization that runs GlobalProtect and has not applied the May fixes should treat this as an active incident risk, not routine patching.

What the bug does

GlobalProtect is the remote-access VPN built into PAN-OS, the operating system on Palo Alto's firewalls. Users sign in through a "portal" and connect to a "gateway." According to Palo Alto's advisory, CVE-2026-0257 lets an attacker bypass authentication on the portal or gateway and set up an unauthorized VPN connection. In practical terms, an outsider ends up on the inside of the network as though they had logged in.

Not every GlobalProtect deployment is exposed. The advisory says exposure requires authentication override cookies to be enabled, together with a specific certificate configuration. Authentication override cookies are a convenience feature: after a user signs in once, a cookie lets them reconnect without signing in again. The advisory classifies the weakness as reliance on cookies without validation and integrity checking. Panorama, Palo Alto's central management product, and Cloud NGFW are not affected.

The vendor currently scores the flaw at CVSS 7.8 (High) under CVSS v4.0, and its advisory sets the exploit maturity to "ATTACKED." The advisory was first published May 13 and last updated June 3. The NVD record, sourced from Palo Alto's PSIRT, carries the same description. It was last modified June 17 and has the status "Analyzed."

How the rating and the warnings changed

Help Net Security reports that the bug was rated medium severity when it was disclosed on May 13. On May 29 the advisory was updated to say Palo Alto had become aware of limited exploit attempts on unpatched devices without mitigations applied. Help Net Security says Rapid7 reported attackers targeting the local administrator account on customer devices starting May 17, four days after the patch, with some reaching internal networks in a second wave on May 21.

Unit 42's October 19 update fills in what happened next. Help Net Security says Unit 42's incident responders have been investigating intrusions linked to the vulnerability since early June. The Register quotes Unit 42's Andy Piazza on the core problem: attackers use the flaw to gain an initial foothold and then bypass multi-factor authentication to establish a VPN session. Many organizations rely on MFA as a main protection on their VPN, and this flaw undercuts it.

Unit 42 is not the only firm tracking the activity. According to Help Net Security, ReliaQuest tracked exploitation by several threat groups, including the Qilin and Settra ransomware operations. These attributions come from the security firms named. Help Net Security and The Register do not report that any victim has confirmed which group attacked it.

From VPN to hypervisor

The intrusion pattern Unit 42 describes follows a familiar ransomware playbook. The VPN provides the way in, and the rest of the attack is about getting control of the whole environment.

  • Initial access past MFA. The attackers use CVE-2026-0257 to get a VPN session without passing the normal MFA check.
  • Chaining with an old backup bug. Unit 42, as reported by Help Net Security and The Register, has also seen attackers chain this initial access with exploit tools targeting Veeam backup infrastructure (CVE-2023-27532). Backup servers are a frequent ransomware target because they hold credentials and because destroying backups increases the pressure to pay.
  • Lateral movement. According to The Register, the intruders moved across networks over Remote Desktop Protocol and SMB, the standard Windows remote-desktop and file-sharing protocols, dropping additional malware for credential harvesting and data theft before deploying ransomware.
  • Going for the virtualization layer. In one case Unit 42 investigated, according to Help Net Security, the attackers went from the compromised VPN gateway to the vCenter management appliance, turned off security controls on the ESXi hypervisors, and ran a custom tool against a domain controller's virtual disk to extract credentials offline.

Piazza called that last step a way to bypass in-guest endpoint detection and response and a "highly sophisticated method" of obtaining domain-wide credentials. The logic is straightforward: if an attacker can read a domain controller's virtual disk from the hypervisor, the Active Directory credential database can be pulled without logging in to the domain controller, so endpoint tools on that server may never see the theft. Control of ESXi also gives an attacker a view of every virtual machine underneath it.

Who has been hit

The Register quotes Unit 42 as seeing activity across numerous industries, including education, financial services, healthcare, high tech, hospitality, manufacturing, professional and legal services, government, transportation and logistics, utilities and energy, and wholesale and retail. That list covers a large share of the economy. Palo Alto did not respond to The Register's questions about how many organizations have been compromised.

What It Means for Defenders

Who is affected: Organizations running GlobalProtect portals or gateways on PAN-OS, particularly those with authentication override cookies enabled, are affected. Palo Alto says exposure requires those cookies plus a specific certificate configuration. Panorama and Cloud NGFW are not impacted.

Patch now. Palo Alto lists these fixed PAN-OS releases (or later):

  • PAN-OS 12.1: 12.1.4-h6, 12.1.7
  • PAN-OS 11.2: 11.2.4-h17, 11.2.7-h14, 11.2.10-h7, 11.2.12
  • PAN-OS 11.1: 11.1.4-h33, 11.1.6-h32, 11.1.7-h6, 11.1.10-h25, 11.1.13-h5, 11.1.15
  • PAN-OS 10.2: 10.2.7-h34, 10.2.10-h36, 10.2.13-h21, 10.2.16-h7, 10.2.18-h6

Pick the fixed release that matches your current minor version; the advisory maps each version range to its upgrade target. The advisory also notes that after the upgrade, GlobalProtect users will need to re-authenticate once, even if a valid cookie is present.

For Prisma Access, the advisory lists fixed versions of 11.2.7-h13 and 10.2.10-h36 and says Prisma Access is being actively upgraded for all customers on the schedule shared with them. Prisma Access customers should confirm with Palo Alto that their tenants have been upgraded.

Assume compromise if you patched late. Rapid7 reportedly saw exploitation within days of the advisory, and Unit 42 has been investigating intrusions since June. ReliaQuest cautions that patching alone may not remove access established before remediation, and advises ending all active GlobalProtect sessions after patching. If your gateways were exposed between mid-May and your patch date, review the evidence:

  • Review GlobalProtect connection logs for sessions that do not match a known user, device, or normal MFA event, including unexpected hostnames.
  • Check whether authentication override cookies are enabled, and decide whether you need them; ReliaQuest advises disabling them where they are not needed.
  • Look for unexpected RDP and SMB activity that starts from VPN address pools.
  • Check Veeam servers for CVE-2023-27532, and confirm backup infrastructure is patched and isolated.
  • Audit vCenter and ESXi access logs for unfamiliar logins, changes to ESXi security settings, and any access to domain controller virtual disks.

Rotate credentials if the hypervisor was touched. If there is any sign that attackers reached vCenter or ESXi, treat all Active Directory credentials as exposed. That includes service accounts and the krbtgt account. Plan a full credential reset as part of incident response. Unit 42 also publishes indicators of compromise that can support threat hunting.

For CMMC and federal contractors: government is on the list of affected sectors. If a VPN compromise leads to theft of domain credentials, check your contract and regulatory incident-reporting obligations with counsel. Document when you patched and what you checked.

Sources