How Ransomware Gangs Are Exploiting the Palo Alto GlobalProtect Flaw

WarBrief Live | October 20, 2026 | Cybersecurity

Five months after Palo Alto Networks patched the flaw, ransomware crews are still walking into corporate networks through the company’s own GlobalProtect VPNs — no password required. CVE-2026-0257, an authentication bypass in the GlobalProtect portal and gateway of PAN-OS, lets an attacker forge an authentication cookie and open a fully authorized VPN session. Palo Alto disclosed the flaw on May 13, 2026, CISA added it to its Known Exploited Vulnerabilities (KEV) catalog on May 29, and yet threat researchers say exploitation is not only continuing but spreading to new ransomware operations. This is CVE-2026-0257, the Palo Alto GlobalProtect flaw, explained: what investigators confirmed, and what remains unverified.

What is CVE-2026-0257?

CVE-2026-0257 is an authentication bypass in the GlobalProtect portal and gateway of Palo Alto Networks’ PAN-OS firewall software. GlobalProtect is the company’s primary remote-access VPN product, built into PAN-OS firewalls and delivered as a cloud service through Prisma Access. Palo Alto disclosed the vulnerability in its security advisory on May 13, 2026, and classified the exploit maturity as “Attacked” — meaning the flaw was already being exploited in the wild at disclosure time.

The flaw sits in GlobalProtect’s authentication-override feature, which hands an already-authenticated user an encrypted cookie so they can reconnect without logging in again. The vulnerability is classified as CWE-565: reliance on cookies without validation and integrity checking. In vulnerable configurations, the cookie is encrypted with the same certificate that serves the portal’s HTTPS interface. An attacker who simply connects to the portal can retrieve the public key, forge a valid cookie, and present it to the gateway — which decrypts it and accepts it without ever verifying a signature.

One important precision: not every GlobalProtect deployment is exposed. The bypass only works where authentication-override cookies are enabled on a portal or gateway together with a specific certificate configuration. Exposure depends on configuration, not just on the software version.

How does the GlobalProtect authentication bypass work?

In plain terms, the attack works like this. The victim organization runs a GlobalProtect portal or gateway with the authentication-override feature switched on. The attacker opens a connection to that portal, takes the public key from its certificate, and uses it to craft an authentication-override cookie containing arbitrary session data — including, in the worst case, administrative accounts. The gateway receives the cookie, base64-decodes it, decrypts it with the configured private key, and trusts whatever comes out. No signature check happens after decryption.

Technical analysis by Rapid7, summarized in an OpenVPN security blog, puts the root cause this way: the incoming encrypted cookie is “base64 decoded and then decrypted using a private key. The decrypted content is then trusted implicitly, with no signature verification of any kind occurring after decryption.” The flaw was traced to the main_DecryptAppAuthCookie function of the gpsvc binary. Because the forged session passes through the organization’s own GlobalProtect gateway, the intrusion initially looks like ordinary remote work — which is exactly why it is so attractive to ransomware crews.

CVE-2026-0257 by the numbers

The figures below separate what multiple sources confirm from what only a single source reports.

Caveat: “Confirmed” figures are corroborated by two or more independent sources; “Reported” figures come from a single source and should be treated with caution.

Who is exploiting the flaw, and what happens after they get in?

The ransomware angle is what has kept this five-month-old vulnerability in the headlines. Qilin affiliates were linked to attacks abusing CVE-2026-0257 as early as June 2026; Arctic Wolf’s July 20 report tied June intrusions that ended in Qilin ransomware deployments to the flaw, noting VPN sessions originating from machines named “kali.” That hostname is an investigation lead, not proof of compromise on its own.

The threat-actor picture widened in October. Threat-detection firm ReliaQuest reported that the Settra data-extortion gang — a newer operation — is also exploiting CVE-2026-0257 to open VPN sessions and breach internal networks, and assessed it “highly likely” the exploitation will continue for at least the next three months. Palo Alto’s own Unit 42, in a threat brief updated October 19, 2026, says it continues to observe attempted exploitation by ransomware operators including Spikey Scorpius (Qilin) and Tarnished Scorpius (Inc), and notes public reporting attributing exploitation to Settra actors.

Once inside, attackers look like any other remote worker — which buys them time to steal credentials, move laterally, and collect data before deploying ransomware. ReliaQuest says it has seen common post-compromise tooling — Cobalt Strike, BloodHound and SharpHound — used in the follow-on activity. SOCRadar’s “Operation Master” report, published September 24, described seven gateways in four countries compromised through the flaw, with the stolen access feeding a fraud operation that generated millions of fake invoices. One report also describes attackers pivoting toward hypervisor management, including attempts to disable security on ESXi hosts — that specific behavior is reported by a single source and remains unverified elsewhere.

Unit 42’s October 19 update adds a moderating note: only a small portion of probed devices actually established VPN sessions, and it has not identified post-access lateral movement in all the activity it reviewed. Attempted exploitation is ongoing; mass compromise of every exposed gateway is not what the data shows.

What the GlobalProtect flaw means for US/UK/EU readers

For most readers, the direct impact runs through employers and services, not personal devices. GlobalProtect is an enterprise VPN: if your company uses it for remote access, an unpatched gateway is an open door that does not even need a stolen password. Ransomware deployed through such access is what takes payroll systems, hospital portals, and logistics platforms offline — the service outages readers actually feel.

For US readers: the federal deadline (June 1, 2026) has long passed, but CISA keeps the flaw on its KEV list with known ransomware campaign use — which typically means state and local agencies plus critical-infrastructure operators are still being pushed to verify remediation. For UK and EU readers: the exposure is identical, because the flaw is in the product, not the jurisdiction. British and European organizations running the affected PAN-OS trains face the same forged-cookie risk, and their security teams should be asking vendors and managed-service providers one question — whether authentication-override cookies are enabled anywhere on their estate.

For readers who work from home over a corporate VPN: you cannot patch a firewall yourself, but you can report anything odd — unexpected re-authentication prompts, logins from unfamiliar locations, or IT asking for credentials over the phone (a classic follow-on to access like this). For a deeper primer on how ransomware crews operate once they are in, see WarBrief’s ransomware-as-a-service explainer, and for a recent case study, how Rhysida monetized a Maryland county breach.

How to fix CVE-2026-0257: the patch and mitigations

Security teams should treat this as a patch-adoption problem as much as a vulnerability problem — the flaw has been patchable for roughly five months, yet exploitation continues. Palo Alto’s guidance and independent advisories converge on the same steps:

• Upgrade to the fixed build for your PAN-OS train (12.1, 11.2, 11.1, 10.2) or Prisma Access release (11.2.0, 10.2.0). The vendor’s security advisory lists the fixed versions per train — apply the one that matches your deployment.
• Disable authentication-override cookies wherever they are not needed. This removes the vulnerable code path entirely.
• Use a dedicated certificate for the cookies instead of reusing one from another service, and enable HMAC validation on the cookies (enable-auth-override-cookie-hmac), as independent researchers advise.
• Terminate all active VPN sessions after patching, in case a forged session is already established.
• Hunt the published indicators. Unit 42’s threat brief lists IP addresses seen in pre-proof-of-concept activity — including 23.128.228.6, 104.207.144.154, 146.19.216.119, 146.19.216.120, 146.19.216.125, 179.43.172.213, 185.195.232.139, 198.12.106.60 and 202.144.192.47 — and recommends searching GlobalProtect logs for successful gateway-connected events from any IP using suspicious host IDs or device names, including aa:bb:cc:dd:ee:ff.

Rapid7 independently reported observing exploitation of the same bypass, reinforcing that this is not a single-vendor warning. For background on how extortion gangs pick their targets, WarBrief’s report on the n0n Group’s shipping-extortion campaign shows the same playbook in a different sector. More analysis like this lives in WarBrief’s intelligence section.

What to watch next in the CVE-2026-0257 exploitation wave

Three things will decide whether this flaw fades or festers. First, patch adoption: ReliaQuest expects ransomware groups and initial-access brokers to keep hunting unpatched firewalls for months, which means the exposed population — whatever its true size — is the battleground. Second, actor spread: with Qilin, Settra and Inc all linked to the flaw, the question is whether it gets commoditized into exploit kits that lower-tier crews can use without bespoke tooling. Third, victim disclosure: named corporate victims and any law-enforcement action against the crews abusing the flaw would signal whether this is a contained campaign or a broad one.

The uncomfortable lesson of CVE-2026-0257 is structural, not technical: a five-month-old patch has not stopped the attacks, because the exposed systems were never patched in the first place. In VPN security, the configuration setting nobody reviewed is worth more to an attacker than a zero-day.

Frequently asked questions

What is CVE-2026-0257 in Palo Alto GlobalProtect?
It is an authentication bypass in the GlobalProtect portal and gateway components of Palo Alto Networks’ PAN-OS software. An attacker can forge an authentication-override cookie — because the gateway decrypts it without verifying a signature — and establish a full VPN session with no credentials. It was disclosed on May 13, 2026, and CISA added it to its Known Exploited Vulnerabilities catalog on May 29.

How does the GlobalProtect authentication bypass work?
GlobalProtect’s authentication-override feature passes encrypted cookies between portal and gateway to avoid double logins. In vulnerable configurations, the cookie is encrypted with the same certificate that serves the portal’s HTTPS interface, so anyone can retrieve the public key, forge a cookie with arbitrary user data, and have the gateway accept it as legitimate — with no HMAC or signature check.

Which PAN-OS versions are affected by CVE-2026-0257?
PAN-OS trains 12.1, 11.2, 11.1 and 10.2, plus Prisma Access 11.2.0 and 10.2.0 — but only where authentication-override cookies are enabled together with a specific certificate configuration. Panorama appliances and Cloud NGFW are not affected.

Who is exploiting CVE-2026-0257 — and how long will it last?
Confirmed actors include the Qilin ransomware operation (active since June 2026), the newer Settra gang (since October, per ReliaQuest), and Inc ransomware (per Palo Alto’s Unit 42). ReliaQuest assesses it “highly likely” that exploitation will continue for at least the next three months, as ransomware groups and initial-access brokers keep scanning for unpatched gateways.

What should my company do if we use GlobalProtect?
Upgrade to the fixed build for your PAN-OS train, disable authentication-override cookies where they are not needed, use a dedicated certificate for them with HMAC validation enabled, terminate active VPN sessions after patching, and search GlobalProtect logs for Unit 42’s published indicators of compromise. Treat any unpatched gateway as actively at risk.

Sources

• Palo Alto Networks Unit 42: Threat Brief — Active Exploitation of PAN-OS CVE-2026-0257 (updated October 19, 2026)
• Infosecurity Magazine: Old Palo Alto VPN Vulnerability Remains a Target for Ransomware Groups
• Hacker Magazine: Palo Alto GlobalProtect VPN flaw now exploited by ransomware gangs
• OpenVPN Blog: CVE-2026-0257 — GlobalProtect VPN Flaw Hit by Ransomware
• Avertium: Palo Alto Networks GlobalProtect Authentication Bypass — Ransomware Groups Actively Exploiting
• Carthage Electronics: October 11 2026 CVE Threat Brief (ReliaQuest on Qilin/Settra)
• The Acting CISO: The Weekly Cadence (CISA KEV dates verified October 13, 2026)