Qilin and INC ransomware gangs exploit PAN-OS GlobalProtect flaw CVE-2026-0257 to bypass MFA

What Unit 42 reported this week

Unit 42's threat brief on CVE-2026-0257, written by Andy Piazza, was updated on October 19 with this line: "Unit 42 continues to observe attempted exploitation of CVE-2026-0257 by ransomware operators including Spikey Scorpius (aka Qilin) and Tarnished Scorpius (aka Inc)." A further update on October 20 added verification and remediation guidance.

Unit 42 also cites public reporting from ReliaQuest that ties exploitation to actors using Settra ransomware. Across these cases the pattern is the same: the flaw gives an initial foothold, and the attacker uses it to establish a VPN session while bypassing MFA controls.

Industries hit so far, according to Unit 42, include education, financial services, healthcare, high technology, hospitality, manufacturing, professional and legal services, government, transportation and logistics, utilities and energy, and wholesale and retail. No source has published a count of victims or of exposed devices.

From the VPN gateway to the domain controller

The most detailed case in the Unit 42 update shows how far the access can go. In Unit 42's words: "In one notable case, attackers moved from the compromised VPN gateway to the vCenter management appliance. From there, they disabled security controls on ESXi hypervisors (execInstalledOnly) and used a custom tool to perform offline credential dumping directly against a domain controller's virtual disk (VMDK)."

Reading credentials straight from the virtual disk means the domain controller's own endpoint detection never sees the dump happen. Unit 42 says the actors also chain this access with exploits against Veeam backup servers, specifically CVE-2023-27532, a missing-authentication flaw in Veeam Backup & Replication that has been in CISA's Known Exploited Vulnerabilities catalog since August 2023.

Other post-exploitation activity in the reports includes internal reconnaissance with dual-use remote management tools, lateral movement over RDP and SMB, credential harvesting, data exfiltration and ransomware deployment. Cybersecurity Dive, reporting on October 20, adds that Cobalt Strike, BloodHound and SharpHound have been seen in these intrusions.

"About five months after disclosure, the flaw has become a reliable way into networks for ransomware groups, and that will likely continue over the next three months as more groups and access brokers adopt it," Brandon Tirado, VP of ReliaQuest GreyMatter Operations, told Cybersecurity Dive. Justin Moore, Director of Adversary Operations at Arctic Wolf, said: "The timeline suggests that access obtained through exploitation can be quickly converted into persistent remote access and hands-on-keyboard operations that ultimately enable ransomware deployment."

How the GlobalProtect flaw works

Palo Alto's advisory titles CVE-2026-0257 "PAN-OS: GlobalProtect Authentication Bypass Vulnerabilities" and says it lets attackers "bypass security restrictions and establish an unauthorized VPN connection". The root cause is insufficient validation of GlobalProtect authentication override cookies, which lets an attacker forge one. CISA classifies it as CWE-565, reliance on cookies without validation and integrity checking.

Not every GlobalProtect deployment is exposed. Rapid7 lists three conditions that must all be true:

1. Authentication override is enabled on the GlobalProtect portal or gateway.
2. Cloud Authentication Service (CAS) is disabled.
3. The certificate used to encrypt authentication override cookies is not the same certificate used for the portal or gateway HTTPS service.

Cloud NGFW (all versions) and Panorama are not affected.

Why the severity rating changed

The advisory launched on May 13 with a CVSS v4 score of 4.7, rated medium. On May 29 Palo Alto raised it to 7.8, rated high, with urgency HIGHEST and exploit maturity marked ATTACKED. The attack vector is network and the attack complexity is low. Rapid7 advises customers to "treat this as a critical vulnerability" because it sits on the internet-facing VPN edge. Some coverage still describes it as medium, which no longer matches the vendor rating.

Timeline of exploitation

• May 13, 2026: Palo Alto publishes the advisory and fixed builds. The issue was found internally.
• May 17, 2026: Rapid7 first detects exploitation. Its first MDR alert fires on May 18 at 01:51:37 UTC, and a second wave follows on May 21. In 8 out of 10 impacted MDR customers the attacker set up a full VPN tunnel, though Rapid7 saw no lateral movement at that time.
• May 29, 2026: the CVSS score is raised from 4.7 to 7.8, and CISA adds the CVE to its Known Exploited Vulnerabilities catalog with a June 1 remediation deadline and known ransomware campaign use.
• June 3, 2026: Palo Alto adds an FAQ to the advisory.
• June 2026 onward: ransomware-linked exploitation activity observed, per Cybersecurity Dive.
• October 19-20, 2026: Unit 42 names Qilin and INC as active exploiters and publishes the vCenter, ESXi and VMDK attack chain.

Fixed PAN-OS versions

Palo Alto lists these minimum fixed builds. Upgrading to any of them, or a later release in the same branch, closes the flaw.

• PAN-OS 12.1: 12.1.4-h6, or 12.1.7 and later.
• PAN-OS 11.2: 11.2.4-h17, 11.2.7-h14, 11.2.10-h7, or 11.2.12 and later.
• PAN-OS 11.1: 11.1.4-h33, 11.1.6-h32, 11.1.7-h6, 11.1.10-h25, 11.1.13-h5, or 11.1.15 and later.
• PAN-OS 10.2: 10.2.7-h34, 10.2.10-h36, 10.2.13-h21, 10.2.16-h7, or 10.2.18-h6.
• Prisma Access 11.2.0: 11.2.7-h13.
• Prisma Access 10.2.0: 10.2.10-h36.

What admins should do now

1. Upgrade to a fixed PAN-OS or Prisma Access build listed above.
2. If you cannot upgrade right away, apply one of Palo Alto's workarounds: use a dedicated certificate for Authentication Override cookies, or disable Authentication Override.
3. Customers with Threat Prevention can enable signature ID 047910.
4. Check whether the management interface is reachable from the internet. Unit 42 warns that organizations frequently mapped GlobalProtect profiles to HTTP/HTTPS services on their management interfaces, which exposes them on ports such as 4443 and 3879. Test HTTPS connections to those ports and review Interface Management profiles.
5. Assume a patched gateway may already have been used. Hunt in GlobalProtect logs for the indicators below, and review vCenter, ESXi and Veeam servers if any match.

Rapid7 has released a public proof-of-concept script for testing, and its InsightVM and Exposure Command checks have covered the flaw since the May 15 content release.

Sources

• Unit 42, Active Exploitation of PAN-OS CVE-2026-0257: https://unit42.paloaltonetworks.com/active-exploitation-of-pan-os-cve-2026-0257/
• Palo Alto Networks security advisory CVE-2026-0257: https://security.paloaltonetworks.com/CVE-2026-0257
• Rapid7, observed exploitation of CVE-2026-0257: https://www.rapid7.com/blog/post/etr-rapid7-observed-exploitation-of-pan-os-globalprotect-authentication-bypass-vulnerability-cve-2026-0257/
• CISA Known Exploited Vulnerabilities catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• Cybersecurity Dive, October 20, 2026: https://www.cybersecuritydive.com/news/ransomware-targeting-palo-alto-networks-vulnerability/833474/

Key takeaways

• Unit 42 says Qilin and INC ransomware operators are exploiting CVE-2026-0257, and ReliaQuest ties Settra ransomware to it as well.
• The flaw lets attackers forge a GlobalProtect authentication override cookie and open a VPN session past MFA.
• Only gateways with authentication override enabled, CAS disabled and a shared cookie certificate are vulnerable. Cloud NGFW and Panorama are not affected.
• Fixed builds have existed since May 13, 2026, and CISA added the CVE to its KEV catalog on May 29.
• Patch, or use a dedicated cookie certificate or disable Authentication Override, then check ports 4443 and 3879 and hunt the published indicators.