Vulnerabilities
Qilin and Inc ransomware exploit GlobalProtect CVE-2026-0257
Ransomware crews have used a forged-cookie GlobalProtect bypass since June to get VPN sessions without MFA. Fixed builds, mitigations and what to hunt for.
Palo Alto Networks' Unit 42 updated its threat brief on October 19 and 20 to say that two ransomware operations, Qilin (which Unit 42 tracks as Spikey Scorpius) and Inc (Tarnished Scorpius), have been exploiting CVE-2026-0257 in PAN-OS GlobalProtect. ReliaQuest has separately tied the Settra ransomware group to the same flaw. Unit 42's incident responders have been working these intrusions since early June. The bug lets an attacker open a VPN session on the firewall without a password and without the multi-factor authentication (MFA) prompt, and from there the crews have reached vCenter and domain controllers.
Palo Alto disclosed and patched the flaw on May 13. You are exposed if a PA-Series or VM-Series firewall, or Prisma Access, runs GlobalProtect with authentication override cookies turned on and an unpatched build. Panorama and Cloud NGFW are not affected. Patching closes the hole but does not remove a session or account an attacker already set up, so anyone who was exposed between May and their upgrade date should hunt as well as patch.
How it works
GlobalProtect can issue an authentication override cookie after a user logs in, so the client can reconnect later without asking for the password and MFA again. The portal or gateway encrypts that cookie with a certificate's public key and, when the cookie comes back, decrypts it with the private key and trusts what is inside. Palo Alto classes the flaw as CWE-565, reliance on cookies without validation and integrity checking: vulnerable builds accept any cookie they can decrypt and never check that the firewall itself created it.
The weak point is the certificate. Encrypting a cookie only needs the public key, and if the override certificate is the same one the portal or gateway presents on its public HTTPS service, anyone can pull it from a TLS handshake. Arctic Wolf describes attackers doing exactly that, then writing their own cookie for a privileged user such as "admin" and getting a VPN session with no credentials and no MFA. That needs three things together: a GlobalProtect portal or gateway, override cookies enabled (off by default), and the override certificate reused or exposed elsewhere.
The fix adds an integrity check to the cookie. That is why every user has to authenticate once after the upgrade, even with a valid cookie, and why Palo Alto's advisory documents a temporary set global-protect enable-auth-override-cookie-hmac no setting for phased upgrades that must go back to yes once every portal and gateway is upgraded.
The sources do not agree on severity or on when CISA listed the flaw. Palo Alto scores it 7.8 under CVSS 4.0 with its highest suggested urgency, up from 4.7 when it was first published. Singapore's Cyber Security Agency lists 9.1 under CVSS 3.1. Unit 42's brief says the CVE went into CISA's Known Exploited Vulnerabilities (KEV) catalog on May 13, while Arctic Wolf, Field Effect and Beazley Security all give May 29. Treat it as critical whichever number you use.
What attackers are doing
Rapid7 saw the first successful exploitation on May 17, four days after the fix shipped, with attackers aiming at local administrator accounts. A second wave on May 21 reached internal networks. Rapid7 published its analysis and a working proof of concept on May 29, the same day Palo Alto updated its advisory to report exploit attempts.
The ransomware intrusions Unit 42 describes follow a consistent path. After the forged VPN session, the attackers used remote monitoring and management (RMM) tools to look around, moved laterally over RDP and SMB, and staged tools for credential theft, data theft and encryption. ReliaQuest reports Cobalt Strike, BloodHound and SharpHound in the Settra-linked activity. Some intrusions also chained CVE-2023-27532, a Veeam Backup and Replication flaw, to get at backup servers.
In one case the attackers went from the VPN gateway to the vCenter management appliance. They turned off execInstalledOnly on the ESXi hosts, a setting that stops the hypervisor running binaries that were not installed from a signed package. Then they ran a custom tool against a domain controller's virtual disk (VMDK) to pull credentials offline. Reading the disk from the hypervisor never touches the running Windows guest, so endpoint detection and response (EDR) inside the domain controller sees nothing.
Victims span education, financial services, healthcare, government, manufacturing, energy and utilities, transportation, hospitality, retail and legal services. Palo Alto has not said how many organisations were hit.
What to do
1. Upgrade portals and gateways
| Branch | Fixed builds |
|---|---|
| PAN-OS 12.1 | 12.1.4-h6, 12.1.7 or later |
| PAN-OS 11.2 | 11.2.4-h17, 11.2.7-h14, 11.2.10-h7, 11.2.12 or later |
| PAN-OS 11.1 | 11.1.4-h33, 11.1.6-h32, 11.1.7-h6, 11.1.10-h25, 11.1.13-h5, 11.1.15 or later |
| PAN-OS 10.2 | 10.2.7-h34, 10.2.10-h36, 10.2.13-h21, 10.2.16-h7, 10.2.18-h6 or later |
| Prisma Access | 11.2.7-h13 or 10.2.10-h36 |
Upgrade every portal and gateway that generates or accepts cookies, internal ones included. Hybrid Prisma Access setups also need their on-premises firewalls upgraded. Releases older than 10.2 get no fix.
2. If you cannot upgrade today
Check whether you are exposed. On the portal, open Network > GlobalProtect > Portals > (portal) > Agent > (agent config) > Authentication and look at "Generate cookie for authentication override" and "Accept cookie for authentication override". On the gateway, the setting is under Network > GlobalProtect > Gateways > (gateway) > Agent > Client Settings > Authentication Override. Clear those boxes if you can live with users signing in more often. If you need the cookies, issue a new certificate used only for override cookies and never shared with the portal, the gateway or any other feature.
Unit 42's latest update also points to GlobalProtect profiles that admins had mapped to HTTP or HTTPS services on management interfaces. Check your interface management profiles and keep the management plane off anything the internet can reach.
3. Hunt for earlier access
In Monitor > Logs > GlobalProtect, search back to May 13 for successful gateway-connected events. Indicators that both Unit 42 and Rapid7 (via Arctic Wolf) list:
- Source IPs
104.207.144[.]154,146.19.216[.]119,146.19.216[.]120and146.19.216[.]125 - Host ID
aa:bb:cc:dd:ee:ff, a placeholder MAC address that is easy to spoof - Client hostname
kali, which Arctic Wolf and ReliaQuest both flag
Look harder at VPN logins as "admin" or other local accounts, and at any session from a hosting provider. A forged session looks like a normal VPN login, so the source address and account matter more than the event type. If you find one, check vCenter for changes to execInstalledOnly and for access to domain controller disks.
4. Clean up after patching
End every active GlobalProtect session once the upgrade is done, as ReliaQuest advises, so no forged session survives it. If an attacker reached internal systems, reset domain credentials, including the krbtgt account twice, and patch Veeam against CVE-2023-27532.
The VPN is part of the identity system
MFA is usually enforced at the login page. A reconnect cookie that skips that page is a second way in, and here it rested on one certificate setting. Audit every "remember me" feature on your remote access stack the same way you audit password policy: who issues the token, what key protects it, and whether the device checks its own signature.
Our safeguarding and hardening work reviews VPN and firewall configuration, and our security operations team hunts for the kind of quiet VPN logins described here. Open the chat and Yaali, our AI agent, will pass your question to an engineer.
Sources: Unit 42 threat brief, Palo Alto Networks advisory, The Register, Help Net Security, Arctic Wolf, Cyber Security Agency of Singapore, Field Effect, Beazley Security.