Active Exploitation Alert: Palo Alto Networks PAN-OS GlobalProtect Authentication Bypass Vulnerability (CVE-2026-0257)

Executive Summary

CVE-2026-0257 is an authentication bypass vulnerability in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS and Prisma Access. It can let a remote, unauthenticated attacker bypass security restrictions and establish an unauthorized VPN connection (Palo Alto Networks advisory). Palo Alto Networks rates it CVSS v4.0 7.8 (High) with suggested urgency "Highest"; NVD's own assessment is CVSS v3.1 9.1 (Critical).

The flaw is only exploitable in a specific configuration: authentication override cookies must be enabled on a GlobalProtect portal or gateway, and the certificate used for those cookies must be reused elsewhere, for example as the portal or gateway's HTTPS certificate. Panorama and Cloud NGFW are not affected. Fixed PAN-OS and Prisma Access versions are available.

Palo Alto Networks says it is aware of "limited exploit attempts on unpatched PAN-OS devices without mitigations applied." Rapid7 reported exploitation from 17 May 2026, CISA added the CVE to its KEV catalog on 29 May 2026, and as of October Unit 42 reports that ransomware operators are using it (see the update below).

Update (22 Oct 2026): ransomware exploitation

What Unit 42 reports (19 and 20 October 2026). Unit 42 timestamps its updates in Pacific time: the ransomware update at 4:00 p.m. PT on 19 October (02:00 on 20 October, Cyprus time (UTC+3)) and the management-interface guidance at 1:30 p.m. PT on 20 October (23:30 on 20 October, Cyprus time). In its threat brief, Unit 42 says it "continues to observe attempted exploitation of CVE-2026-0257 by ransomware operators including Spikey Scorpius (aka Qilin) and Tarnished Scorpius (aka Inc)", and that it is "aware of public reporting attributing exploitation to threat actors using Settra ransomware." According to Unit 42:

• Attackers use the flaw to gain an initial foothold, "bypassing multi-factor authentication (MFA) controls to establish a VPN session."
• After that, the actors are typically conducting internal reconnaissance with dual-use remote monitoring and management (RMM) tools, moving laterally over RDP and SMB, and staging tools for credential harvesting, data exfiltration and, ultimately, ransomware deployment.
• Its investigations have been ongoing since early June 2026 and span many sectors, including education, financial services, healthcare, high technology, hospitality, manufacturing, professional and legal services, government, transportation and logistics, utilities and energy, and wholesale and retail. Unit 42 does not name any affected organizations.
• In one case, the attackers moved from the compromised VPN gateway to a VMware vCenter management appliance, disabled a security control on ESXi hypervisors and used a custom tool to dump credentials offline from a domain controller's virtual disk. Unit 42 says this bypasses in-guest endpoint detection and response (EDR).
• Unit 42 has also seen actors chain this access with exploit tools aimed at Veeam backup infrastructure (CVE-2023-27532).

Other attributed reporting. Arctic Wolf Labs reported on 20 July 2026 that it investigated "multiple distinct intrusions during June 2026 that resulted in Qilin ransomware deployment, all originating from exploitation of CVE-2026-0257". It says post-exploitation tradecraft varied, "from rapid encryption-only operations to full double-extortion," and assesses with moderate confidence that such intrusions are likely ongoing. In an earlier post on 11 June 2026, Arctic Wolf described an increase in exploitation from 30 May 2026, after a smaller first wave between 17 and 21 May.

Unit 42's added guidance on management-interface exposure (20 October 2026). During incident response work, Unit 42 says it repeatedly saw GlobalProtect profiles mapped to HTTP/HTTPS services on firewall management interfaces. This can expose the management interface to the internet, most notably on ports 4443 and 3879, often without administrators knowing. Unit 42 suggests checking from outside your network whether your management IP answers HTTPS on those ports, and restricting access with Interface Management profiles per Palo Alto Networks' documentation.

What has not changed. The vulnerability, the affected versions and the fixes are the same as in May; the vendor advisory was last updated on 3 June 2026. Exploitation still requires authentication override cookies to be enabled together with the vulnerable certificate configuration. Palo Alto Networks says upgrading to a fixed version resolves the issue, and that its workarounds let customers "mitigate the risk of this issue". Unit 42's earlier note that only a small portion of probed devices actually established VPN sessions still stands in its brief.

What defenders should do now:

1. Patch. Upgrade every GlobalProtect portal and gateway to a fixed version (see the table below). Palo Alto Networks says that where authentication override cookies are used, all portals and gateways, internal and external, should be upgraded together, as should on-premises firewalls in hybrid Prisma Access deployments.
2. Hunt before you close the ticket. Unit 42 advises searching GlobalProtect logs for successful logins and "gateway-connected" events from the IP addresses and host IDs listed in the Indicators section, and from sessions whose client values match the public proof-of-concept defaults it lists. It recommends activating incident response for any successful gateway-connected event linked to these indicators.
3. Assume patching does not remove access already gained. Given the ransomware activity Unit 42 describes, a confirmed suspicious VPN session should be treated as a possible intrusion: review RMM tool use, RDP/SMB movement from VPN address pools, and access to vCenter, ESXi and backup servers. (Rescana guidance.)
4. Check management-interface exposure on ports 4443 and 3879, as described above.
5. If you cannot patch immediately, apply one of the vendor workarounds below.

Threat Actor Profile

June 2026 assessment, now superseded by the update above: Rapid7 reported that early exploitation came from the hosting providers Vultr and Dromatics Systems and used a consistent spoofed MAC address, which led it to believe both waves were likely from the same threat actor. Unit 42 attributed the activity to "an unidentified threat actor". At that time, neither Rapid7 nor Unit 42 had seen post-access lateral movement.

Unit 42 now names Spikey Scorpius (Qilin) and Tarnished Scorpius (INC) among the ransomware operators exploiting the flaw, and notes public reporting about actors using Settra ransomware. Arctic Wolf says the variation it saw across Qilin intrusions possibly suggests multiple affiliates operating under the Qilin ransomware-as-a-service model.

Technical Information

Palo Alto Networks classifies the flaw as CWE-565 (Reliance on Cookies without Validation and Integrity Checking). The issue sits in the GlobalProtect "authentication override" feature, which lets a portal or gateway issue a cookie to an authenticated user so the user can reconnect without re-entering credentials for a configured period. This feature is not enabled by default (Rapid7).

According to Palo Alto Networks and Rapid7, the cookies were not integrity-checked in a way that stops forgery when the certificate used for them is also used elsewhere, such as for the portal or gateway's HTTPS service. In that configuration, a remote attacker could create a cookie that the GlobalProtect service accepts, and log in and establish a VPN session without valid credentials. Palo Alto Networks' fix regenerates cookies "using a more secure method", which means users must re-authenticate once after the upgrade.

Rapid7 published a technical analysis and a proof-of-concept test script on 29 May 2026. Palo Alto Networks raised the CVSS v4.0 score from 4.7 to 7.8 the same day (Rapid7, Arctic Wolf).

MITRE ATT&CK (as mapped by Arctic Wolf): T1190 Exploit Public-Facing Application; T1539 Steal Web Session Cookie; T1133 External Remote Services; T1021.002 SMB/Windows Admin Shares; T1018 Remote System Discovery; T1135 Network Share Discovery; T1087 Account Discovery; T1036 Masquerading. Source: Arctic Wolf TTP mapping for its June campaign write-up.

Exploitation in the Wild

• 13 May 2026: Palo Alto Networks publishes the advisory.
• 17 May 2026: earliest exploitation observed by Rapid7 MDR, from Vultr infrastructure; a second wave from Dromatics Systems followed on 21 May. Rapid7 says "the appliance accepted the cookie without a full VPN session being established in 8 out of 10 impacted MDR customers", and that it did not observe "any indication of successful lateral movement from the devices" (Rapid7).
• 29 May 2026: Rapid7 publishes its analysis and test script; Palo Alto Networks updates the exploitation status and raises the CVSS score; CISA adds CVE-2026-0257 to the KEV catalog (CISA alert).
• 30 May 2026 onward: Arctic Wolf reports an increase in exploitation, with follow-on internal reconnaissance in some intrusions.
• June 2026: Arctic Wolf investigates multiple intrusions that end in Qilin ransomware deployment (published 20 July). Unit 42's investigations begin in early June.
• 20 October 2026, 02:00 and 23:30 Cyprus time (UTC+3): Unit 42 names Qilin and INC operators, then adds the management-interface guidance.

CISA KEV status (live catalog, re-checked 22 Oct 2026, 16:49 Cyprus time (UTC+3); catalog version 2026.10.21, released 21 Oct 2026): CVE-2026-0257, "Palo Alto Networks PAN-OS Authentication Bypass Vulnerability", date added 29 May 2026, due date 1 June 2026, known ransomware campaign use: Known. Required action: "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable."

The Canadian Centre for Cyber Security (AV26-462) has also issued an advisory. Siemens ProductCERT lists RUGGEDCOM APE1808 devices running the Palo Alto Networks Virtual NGFW as affected, with a fix in V11.2.10-h7 (SSA-967325).

Victimology and Targeting

Unit 42 describes investigations across many industries (listed above) and does not name victims. Neither Unit 42 nor Arctic Wolf describes sector-specific targeting. Any organization running an affected version with the vulnerable configuration and an internet-facing GlobalProtect portal or gateway is exposed until it patches or applies a workaround. Exposure is not the same as compromise.

Affected Product Versions

Per the Palo Alto Networks advisory (updated 3 June 2026). Only devices with authentication override cookies enabled and the vulnerable certificate configuration are exposed.

Workaround and Mitigation

Upgrade all affected PAN-OS devices to the fixed versions above. Palo Alto Networks' advisory lists the exact upgrade path for each minor release. After the upgrade, GlobalProtect users must re-authenticate once.

For phased upgrades, Palo Alto Networks documents a temporary CLI setting to keep cookie compatibility between upgraded and non-upgraded components. It says strict HMAC validation must be re-enabled once every portal and gateway is upgraded, to get the full protection of the fix.

If you cannot upgrade immediately, Palo Alto Networks lists two workarounds:

• Use a dedicated certificate for authentication override cookies. Do not reuse the portal or gateway certificate, and do not share it with other features or users. A certificate previously used for other services must not be reused, even if it is removed from those services.
• Disable authentication override (both generating and accepting cookies) on GlobalProtect portals and gateways. This may change how often users are asked to log in (Rescana note).

Hunt and verify using the Unit 42 indicators below; Unit 42 advises activating incident response for any successful gateway-connected event linked to them.

Reduce exposure: restrict who can reach the management interface (including ports 4443 and 3879, per Unit 42), and limit GlobalProtect portal and gateway access where your business allows it (Rescana guidance).

Indicators of Compromise

Published by Unit 42 (defanged). Unit 42 lists these IP addresses for activity before the proof-of-concept release on 29 May 2026; search GlobalProtect logs for successful logins from:

• 23.128.228[.]6
• 104.207.144[.]154
• 146.19.216[.]119
• 146.19.216[.]120
• 146.19.216[.]125
• 179.43.172[.]213
• 185.195.232[.]139
• 198.12.106[.]60
• 202.144.192[.]47

Suspicious host IDs and device names in successful gateway-connected events (Unit 42 says "including but not limited to"):

• aa:bb:cc:dd:ee:ff
• 00:11:22:33:44:55
• WINDOWS-LAPTOP-001
• DESKTOP-GP01
• GP-CLIENT

For activity after the proof-of-concept release, Unit 42 suggests looking for successful gateway-connected events with endpoint_os_version "Microsoft Windows 10 Pro 64-bit" and an empty source_user_info.domain value. Rapid7 also published IP addresses and machine names from its investigations (Rapid7). Infrastructure from hosting providers is often reused, so treat a single IP match as a lead to investigate, not proof of compromise (Rescana guidance).

Sources

• Palo Alto Networks: CVE-2026-0257 Security Advisory (published 13 May 2026, updated 3 June 2026); Unit 42, Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257 (updated 19 and 20 October 2026, Pacific time)
• CISA: Known Exploited Vulnerabilities Catalog entry for CVE-2026-0257 and alert, 29 May 2026
• NVD: CVE-2026-0257; cve.org: CVE-2026-0257
• Rapid7: Observed exploitation of CVE-2026-0257 (29 May 2026)
• Arctic Wolf Labs: Cookie Crumbles: How Exploitation of CVE-2026-0257 Leads to Qilin Ransomware (20 July 2026), increase in exploitation (11 June 2026) and its ATT&CK mapping (CSV)
• Other advisories: Canadian Centre for Cyber Security AV26-462; Siemens ProductCERT SSA-967325 (RUGGEDCOM APE1808)

Why this matters for your vendors

GlobalProtect is a remote-access gateway, so for many of your suppliers and managed service providers it is the front door to the systems that hold your data, and Unit 42's reporting shows that a VPN session opened through this flaw can be a starting point for ransomware. Ask vendors that run Palo Alto firewalls whether they use GlobalProtect with authentication override cookies, whether every portal and gateway is on a fixed version, and whether they have checked their logs against the published indicators (Rescana guidance).

Book a demo to see how Rescana tracks vendor exposure to actively exploited vulnerabilities like CVE-2026-0257.