Ransomware gangs exploit a PAN-OS GlobalProtect bypass fixed since May

Ransomware gangs exploit a PAN-OS GlobalProtect bypass fixed since May

20 October 2026: Palo Alto Networks' Unit 42 says ransomware groups it tracks as Spikey Scorpius (Qilin) and Tarnished Scorpius (Inc) are breaking in through CVE-2026-0257, an authentication bypass in the GlobalProtect portal and gateway of PAN-OS that lets an attacker with no credentials start a VPN session. The fix has been out since 13 May, the flaw has been in CISA's exploited list since the same day, and a public proof of concept appeared on 29 May.

What happens after the VPN session opens

Unit 42's 19 October update describes what followed in its investigations: reconnaissance with remote monitoring and management tools, lateral movement over RDP and SMB, and staging of tools for credential theft, data exfiltration and ransomware. In one case the attackers moved from the VPN gateway to the vCenter appliance and "disabled security controls on ESXi hypervisors (execInstalledOnly)", then dumped credentials offline from a domain controller's virtual disk, a technique that bypasses endpoint detection inside the guest. Some intrusions chained the access with a Veeam Backup & Replication exploit, CVE-2023-27532, the same flaw named in this week's joint advisory on SafePay. Public reporting attributed by ReliaQuest adds a third group, Settra, which Unit 42 has not confirmed.

Fixed releases

PAN-OS line	Fixed in
12.1	12.1.4-h6, 12.1.7
11.2	11.2.4-h17, 11.2.7-h14, 11.2.10-h7, 11.2.12
11.1	11.1.4-h33, 11.1.6-h32, 11.1.7-h6, 11.1.10-h25, 11.1.13-h5, 11.1.15
10.2	10.2.7-h34, 10.2.10-h36, 10.2.13-h21, 10.2.16-h7, 10.2.18-h6

Cloud NGFW and Panorama are not affected. Prisma Access is being upgraded by Palo Alto on a schedule shared with each customer. Palo Alto rates the flaw High (CVSS 7.8) with its highest suggested urgency, and lists two workarounds: a dedicated certificate used only for authentication override cookies, or disabling the authentication override cookie options on the portal and gateway.

Checking whether a firewall was already used

Patching now does not undo a session opened in June. Unit 42 suggests testing from outside whether the management interface answers HTTPS on ports 4443 and 3879, which happens when GlobalProtect profiles are mapped to HTTP or HTTPS services, and restricting it with Interface Management profiles. It publishes nine source IP addresses and the host IDs and device names used by the attack tooling, and points out that the public proof of concept reports a fixed operating system string, "Microsoft Windows 10 Pro 64-bit", with an empty domain, which makes its sessions easy to find in GlobalProtect logs. Any gateway-connected event matching those values is a reason to start incident response. Our VPN software category lists 13 products.

Related on TrustList:

• FBI warns FortiBleed is still hitting exposed FortiGate VPNs
• Cisco Meraki hardening release covers seven flaw classes, top score 9.6
• ModSecurity web application firewall: bypass and crash flaws fixed in 3.0.17 and 2.9.15, one filename bypass still unpatched

Sources

• Unit 42: Threat brief, active exploitation of PAN-OS CVE-2026-0257 (updated 19 and 20 October), 20 October 2026
• Palo Alto Networks: CVE-2026-0257 PAN-OS GlobalProtect Authentication Bypass, 13 May 2026
• Help Net Security: Ransomware groups exploit Palo Alto GlobalProtect flaw, 21 October 2026