Ransomware Gangs Exploit PAN-OS GlobalProtect Flaw

Field notes from the engineering team

Palo Alto Networks published its advisory for CVE-2026-0257 on May 13, 2026. On October 19, its Unit 42 research team updated its threat brief to say ransomware operators are attempting to exploit the flaw, including the groups behind Qilin and Inc. It also points to public reporting that ties some activity to operators of Settra ransomware. The flaw is an authentication bypass in the GlobalProtect VPN portal and gateway on PAN-OS firewalls. An attacker who exploits it gets a VPN session into your network without valid credentials.

Unit 42 describes a first foothold, then remote management tools for reconnaissance, then movement across the network to the virtualization layer. If your firewall runs GlobalProtect and you have not checked it since spring, check it this week.

The short version

Item	Detail
What it is	CVE-2026-0257, an authentication bypass in the GlobalProtect portal and gateway of PAN-OS. It lets an attacker establish an unauthorized VPN connection.
Severity	CVSS v4.0 7.8 (High). Palo Alto Networks rates the suggested urgency “HIGHEST.”
Who is affected	PAN-OS firewalls with a GlobalProtect portal or gateway configured, authentication override cookies enabled, and a specific certificate configuration. Panorama and Cloud NGFW are not affected. Prisma Access is also affected, and Palo Alto Networks is upgrading it on its own schedule.
Exploited?	Yes. CISA added it to its Known Exploited Vulnerabilities catalog on May 29, 2026, and marks it as used in known ransomware campaigns. Unit 42 reports attempts by Qilin and Inc operators, and public reporting names Settra operators. Arctic Wolf investigated June 2026 intrusions that ended in Qilin encryption.
What to do	Check your PAN-OS version against the fixed releases below, upgrade every portal and gateway, or turn off authentication override cookies. Review GlobalProtect logs. Confirm the management interface is not exposed. Confirm Veeam is patched.

What the flaw is

Palo Alto Networks classifies CVE-2026-0257 as reliance on cookies without validation and integrity checking (CWE-565). In plain terms, GlobalProtect can be made to accept an authentication cookie it should not trust, and the VPN connection is established anyway.

The advisory says exposure requires all of the following:

• A GlobalProtect portal or gateway is configured on the firewall.
• Authentication override cookies are enabled. In the portal’s agent configuration, that is “Generate cookie for authentication override” or “Accept cookie for authentication override.” On the gateway, it is “Accept cookie for authentication override.”
• A specific certificate configuration exists. The advisory does not spell it out, but its workaround says not to reuse the portal or gateway certificate for authentication override cookies. Rapid7’s analysis explains why: the GlobalProtect service decrypts the cookie and trusts what is inside without checking a signature, so anyone who can learn the public key of the certificate used for the cookie can forge one. If that certificate is also the one the portal or gateway presents over HTTPS, the key is public.

Rapid7 saw successful exploitation across multiple managed detection customers, the earliest on May 17, 2026. In the devices it examined, authentication override cookies were enabled on the portal or gateway. Rapid7 also notes the feature is not on by default. Its alert was a cookie-based login to a local account named “admin” from a hosting provider’s address.

One scoring detail is worth knowing. Rapid7 reports the advisory first rated the flaw 4.7 (medium) and that Palo Alto Networks raised it to 7.8 on May 29. If your patching queue was sorted by the original score, this one may be sitting lower than it should.

What attackers do once they are in

CISA’s catalog entry and the vendor advisory describe the entry point. Unit 42 and Arctic Wolf describe what happens next.

Unit 42 says attackers use the flaw to get an initial foothold in a corporate network, bypass multi-factor authentication to establish a VPN session, and then typically:

• Run internal reconnaissance with remote monitoring and management (RMM) tools.
• Move laterally over RDP and SMB.
• Stage tools for credential theft, data exfiltration, and ransomware deployment.

Its investigations have run since early June 2026 and covered education, financial services, healthcare, high technology, hospitality, manufacturing, professional and legal services, government, transportation and logistics, utilities and energy, and wholesale and retail.

The notable change is the jump to the virtualization layer. In one case, attackers moved from the compromised VPN gateway to the vCenter management appliance, disabled a security control on the ESXi hosts (execInstalledOnly), and used a custom tool to dump credentials offline from a domain controller’s virtual disk file (VMDK). Because that happens outside the guest operating system, endpoint detection running inside the domain controller never sees it. Unit 42 also reports attackers chaining the VPN foothold with exploit tools aimed at Veeam backup infrastructure (CVE-2023-27532).

Arctic Wolf’s June 2026 casework shows how quickly this can go. It investigated several intrusions that began with CVE-2026-0257 and ended in Qilin encryption across the domain. Some cases involved no data theft. Others involved AnyDesk, Ngrok, and LogMeIn for persistence and uploads of stolen data to cloud storage before encryption. The intrusions shared several habits: ransomware staged in C:\PerfLogs\, PsExec used over administrative shares, and a PowerShell routine that cleared Windows event logs.

Fixed versions

These come from the Palo Alto Networks advisory for CVE-2026-0257 (published May 13, 2026, last updated June 3, 2026). Find your current release in the left column and move to the fixed release for that line, or to a later one. The advisory also lists Prisma Access 10.2 and 11.2 fixes; Palo Alto Networks handles those upgrades.

If you run	Upgrade to
PAN-OS 12.1.5 through 12.1.6	12.1.7 or later
PAN-OS 12.1.2 through 12.1.4-h*	12.1.4-h6, or 12.1.7 or later
PAN-OS 11.2.11 or later	11.2.12 or later
PAN-OS 11.2.8 through 11.2.10-h*	11.2.10-h7, or 11.2.12 or later
PAN-OS 11.2.5 through 11.2.7-h*	11.2.7-h14, or 11.2.12 or later
PAN-OS 11.2.0 through 11.2.4-h*	11.2.4-h17, or 11.2.12 or later
PAN-OS 11.1.14 or later	11.1.15 or later
PAN-OS 11.1.11 through 11.1.13-h*	11.1.13-h5, or 11.1.15 or later
PAN-OS 11.1.8 through 11.1.10-h*	11.1.10-h25, or 11.1.15 or later
PAN-OS 11.1.7 through 11.1.7-h*	11.1.7-h6, or 11.1.15 or later
PAN-OS 11.1.5 through 11.1.6-h*	11.1.6-h32, or 11.1.15 or later
PAN-OS 11.1.0 through 11.1.4-h*	11.1.4-h33, or 11.1.15 or later
PAN-OS 10.2.17 through 10.2.18-h*	10.2.18 or 10.2.18-h6 or later
PAN-OS 10.2.14 through 10.2.16-h*	10.2.16-h7, or 10.2.18-h6 or later
PAN-OS 10.2.11 through 10.2.13-h*	10.2.13-h21, or 10.2.18-h6 or later
PAN-OS 10.2.8 through 10.2.10-h*	10.2.10-h36, or 10.2.18-h6 or later
PAN-OS 10.2.0 through 10.2.7-h*	10.2.7-h34, or 10.2.18-h6 or later
Any older, unsupported PAN-OS	A supported fixed version

Check the advisory itself before you schedule the change window, because Palo Alto Networks can revise it. Three points from its FAQ affect planning:

• Upgrade every GlobalProtect portal and gateway that generates or accepts these cookies, internal and external, not just the one facing the internet. A partial upgrade can cause cookie compatibility problems between portals and gateways.
• The fix regenerates the authentication override cookie by a more secure method, so GlobalProtect users must sign in again once after the upgrade.
• In a hybrid deployment with Prisma Access, upgrade the on-premises firewalls too.

If you cannot upgrade immediately, the advisory lists two mitigations. You can generate a new certificate used only for authentication override cookies (not shared with the portal, the gateway, or anything else), or you can disable authentication override by unchecking the generate and accept options on the portal and gateway.

What to do, in order

This list is written for a small IT team with one or two firewalls.

1. Find out whether you are exposed. Log in to the firewall and note the PAN-OS version. Then check the cookie settings using the paths in the advisory: Network > GlobalProtect > Portals > your portal > Agent > Authentication, and Network > GlobalProtect > Gateways > your gateway > Agent > Authentication Override. If neither generate nor accept is checked, you are outside the configuration the advisory describes, but you should still patch.

2. Patch, or apply a mitigation today. Use the table above. If a change window is days away, disable authentication override or move the cookie to a dedicated certificate now (the advisory’s two mitigations). Tell users they will need to sign in again.

3. Review GlobalProtect logs. Unit 42 asks defenders to hunt for successful gateway-connected events. Its guidance comes down to three searches:

• Successful logins from the IP addresses it lists for pre-proof-of-concept activity (the proof-of-concept was released May 29, 2026).
• Successful gateway-connected events from any IP address that use the host IDs or device names below.
• Successful gateway-connected events after the proof-of-concept release that report an endpoint_os_version of “Microsoft Windows 10 Pro 64-bit” with an empty source_user_info.domain. Unit 42 says these are hard-coded values from the proof-of-concept code.

Indicators from the Unit 42 brief (defanged):

23.128.228[.]6
104.207.144[.]154
146.19.216[.]119
146.19.216[.]120
146.19.216[.]125
179.43.172[.]213
185.195.232[.]139
198.12.106[.]60
202.144.192[.]47

aa:bb:cc:dd:ee:ff
00:11:22:33:44:55
WINDOWS-LAPTOP-001
DESKTOP-GP01
GP-CLIENT

Go back as far as your logs allow. Rapid7 saw exploitation as early as May 17. If the firewall only keeps a few weeks of logs locally, check whether a syslog server or SIEM holds more. Rapid7’s own detection was a cookie login to the local admin account, so check for that too.

A match is not proof of compromise, and no match is not proof of safety, because the attackers can change hosts and addresses. Unit 42 recommends treating any successful gateway-connected event tied to these indicators as an incident.

4. Make sure the management interface is not exposed. Unit 42 says that during incident response work on an earlier campaign (Lunar Peak), it repeatedly found GlobalProtect profiles mapped to HTTP and HTTPS services on the management interface, which exposes it to the internet on ports 4443 and 3879, often without the administrator knowing. To test, try an HTTPS connection to your management IP address on both ports from a browser outside your network. If either answers, review your Interface Management profiles in the Palo Alto Networks documentation and restrict access.

5. Check that Veeam is patched. CVE-2023-27532 is a missing-authentication flaw in Veeam Backup & Replication that lets an unauthenticated user inside the backup network obtain encrypted credentials from the configuration database. Veeam published its fix in March 2023 (KB4424) and CISA lists the flaw as used in known ransomware campaigns. Compare your build number against the fixed builds in KB4424. Veeam says the flaw affects all earlier versions, so a server on an old release should move to a supported version first. The vulnerable service listens on TCP 9401 by default, so also check that VPN users have no reason to reach that port on the backup server. Our backup and disaster recovery team can review a backup setup.

6. Limit what a VPN session can reach. In the case Unit 42 describes, attackers went from the VPN gateway to vCenter. Check which internal networks your VPN address pool can route to. Management interfaces for vCenter, ESXi, backup servers, and domain controllers should be reachable only from the admin workstations that need them.

7. Rotate credentials if you find anything. An upgrade closes the door. It does not remove someone who is already inside. If the log review turns up suspect sessions, plan on resetting the affected accounts, local firewall accounts, and service accounts that the VPN session could have reached.

When to call for incident response

Call before you investigate further if any of these apply:

• A successful gateway-connected event matches Unit 42’s indicators.
• A VPN session from an unfamiliar host appears with a local or administrative account.
• You find RMM tools you did not install (AnyDesk, Ngrok, LogMeIn, and similar), PsExec activity, or log clearing on servers.
• Anything unexpected has changed on vCenter, ESXi, or the backup server.
• You cannot establish when the firewall was last patched and have no logs to check.

Unit 42 recommends activating incident response for any successful gateway-connected event linked to its indicators. Before you change anything, export the logs and the firewall configuration, and do not wipe or rebuild a system until a responder has looked at it.

Why this keeps happening to VPNs

A firewall VPN sits on the public internet and, once someone is authenticated to it, puts them on the internal network. When the authentication step fails, as it did here, the attacker is on that network, and what they can reach depends on how it is segmented.

We have been writing about replacing the corporate VPN for that reason. Replacement does not fix this CVE, and patching comes first. An access model that grants one application at a time, with identity and device checks on each request, gives an attacker less to reach than a tunnel into the whole network. Our earlier posts cover how a phased VPN retirement works, the business case for replacing a VPN, and giving contractors access without a VPN client.

If you want a second set of eyes on a firewall, a log review, or a backup server, our firewall and routing, Cloudflare Zero Trust, managed SOC, and incident response teams work with organizations such as municipalities, law firms, healthcare practices, and manufacturers. Contact us if you are not sure where you stand.

Sources

• Palo Alto Networks security advisory: CVE-2026-0257 PAN-OS: GlobalProtect Authentication Bypass Vulnerabilities
• Unit 42: Threat Brief: Active Exploitation of May 2026 PAN-OS CVE-2026-0257 (updated October 20, 2026)
• CISA Known Exploited Vulnerabilities Catalog
• Rapid7: Observed Exploitation of PAN-OS GlobalProtect Authentication Bypass Vulnerability (CVE-2026-0257)
• Arctic Wolf Labs: Cookie Crumbles: How Exploitation of CVE-2026-0257 Leads to Qilin Ransomware
• Veeam KB4424: CVE-2023-27532
• NIST NVD: CVE-2023-27532