Palo Alto GlobalProtect VPN Flaw CVE-2026-0257 Still Fuels Ransomware

What's happening with CVE-2026-0257 right now

CVE-2026-0257 is an authentication-bypass vulnerability in the GlobalProtect portal and gateway components of Palo Alto Networks' PAN-OS software. Palo Alto patched it in May 2026, and the company's security advisory still lists the flaw's exploit maturity as "ATTACKED." That status hasn't improved with time: in a threat brief last substantively updated October 20, 2026, Palo Alto's own Unit 42 research team says it has tracked ransomware operators abusing the bug continuously since early June 2026, across victims in education, healthcare, financial services and government.

Unit 42 names the ransomware clusters it tracks as Spikey Scorpius, which it says is publicly known as Qilin, and Tarnished Scorpius, publicly known as Inc. Separate, independently published research from Arctic Wolf Labs reached a similar conclusion in July: its investigators traced "multiple distinct intrusions" in June 2026 back to this same CVE, each one escalating from a GlobalProtect login bypass to domain-wide Qilin ransomware encryption. Arctic Wolf said at the time it assessed "with moderate confidence" that this exploitation was likely still ongoing — and Unit 42's October update confirms that it was.

In short: this is a five-month-old, publicly patched vulnerability that is still functioning as a live ransomware on-ramp, which is why it remains one of the more urgent items on any firewall administrator's patch list heading into November.

What CVE-2026-0257 actually is

According to Palo Alto Networks' security advisory and the official description mirrored on the National Vulnerability Database (NVD), CVE-2026-0257 covers authentication-bypass vulnerabilities in the GlobalProtect portal and gateway of PAN-OS. The flaw is classified as CWE-565 — reliance on a cookie without proper validation. In practice, where "Authentication Override" cookies are configured and share a certificate with the portal or gateway itself, an attacker can forge or replay a valid-looking cookie and establish an unauthorized VPN session without supplying real credentials.

Scoring for the bug has looked inconsistent across write-ups, but that's because two different CVSS systems are both in play, not because the number changed. NVD lists CVE-2026-0257 at 9.1 under CVSS 3.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) and separately at 7.8 under CVSS 4.0, where the vector also carries an Exploit Maturity rating of "E:A" — Attacked. Palo Alto's own advisory publishes only the CVSS 4.0 figure, 7.8, and flags it "Suggested Urgency: HIGHEST." Panorama and Cloud NGFW are explicitly not affected.

Affected products and fixed versions

Palo Alto's advisory lists specific PAN-OS and Prisma Access builds that need the fix. If you manage GlobalProtect portals or gateways, check your running version against the table below.

CVSS v4.0 base/threat score: 7.8 (High); CVSS v3.1: 9.1 (Critical); CWE-565; initial advisory published May 13, 2026, with the NVD record last modified October 26, 2026.

How Qilin and Inc turn a VPN bug into ransomware

A bypassed login page is only step one. According to Unit 42's threat brief, once attackers establish an unauthorized GlobalProtect VPN session using the forged cookie, they move quickly: internal reconnaissance with legitimate, dual-use remote monitoring and management (RMM) tools, lateral movement over RDP and SMB, and staging of tools for credential harvesting, data exfiltration and ransomware deployment. In at least one documented case, Unit 42 says attackers pivoted from the VPN gateway to a VMware vCenter management appliance, disabled security controls on the ESXi hypervisor, and then used a custom tool to dump credentials offline from a domain controller's virtual disk — a technique designed specifically to bypass in-guest endpoint detection. Separately, Unit 42 observed the same access chained with exploitation of a Veeam backup vulnerability to compromise backup infrastructure too, which is a standard ransomware-crew move to prevent easy recovery.

Arctic Wolf Labs' independent investigation of June 2026 intrusions, published in July, adds granular detail on the ransomware stage itself. In the cases it reviewed, the Qilin payload was consistently named win.exe, staged under paths like C:\PerfLogs\, and required a runtime password plus a --no-admin flag to avoid triggering a UAC prompt. Attackers set persistence through registry Run keys and scheduled tasks, deployed remote-access tools such as AnyDesk and the MeshAgent framework, dumped LSASS credentials via rundll32 and comsvcs.dll, and used tools including NetExec, SoftPerfect Network Scanner and PsExec to map and move across the network. For exfiltration, Arctic Wolf saw Rclone and FileZilla pushing data out to destinations including MEGA, consistent with a double-extortion model — encrypt the files and also threaten to leak the stolen data.

Because Qilin and Inc both operate as ransomware-as-a-service (RaaS) brands, Unit 42 and Arctic Wolf both describe the activity as coming from multiple affiliates with varying tradecraft rather than one single operator, which helps explain why the attack hasn't burned itself out: as word of a working exploit spreads inside a RaaS affiliate program, more independent crews pick it up.

Timeline: from May patch to October's renewed warning

How to check if you're exposed

Start by confirming your running PAN-OS or Prisma Access version against the table above. If you're on a vulnerable build, Palo Alto's advisory and Unit 42's brief both recommend the following checks regardless of whether you've already patched:

• Confirm whether GlobalProtect Authentication Override cookies are enabled, and if so, whether the certificate used for them is dedicated or shared with the portal/gateway certificate — a shared certificate is the exploitable configuration.
• Check whether GlobalProtect profiles are mapped to HTTP/HTTPS services on management interfaces, which can expose ports such as 4443 and 3879 beyond where you intended; restrict exposure with Interface Management profiles.
• Review GlobalProtect portal and gateway logs for unexpected successful authentication events, especially sessions that originate from unfamiliar source IPs or that lack a normal credential-entry step.
• If you find evidence of a successful gateway connection you can't account for, treat it as a confirmed intrusion and start incident response rather than just patching and moving on — Unit 42's case data shows how fast initial access can turn into domain-wide ransomware.

How to patch and mitigate CVE-2026-0257

Palo Alto's guidance, confirmed on its own advisory page, is straightforward:

• Upgrade. Move to one of the fixed PAN-OS or Prisma Access builds listed in the table above. This is the only complete remediation.
• If you can't patch immediately, mitigate. Use a dedicated certificate for Authentication Override cookies that is never shared with the portal or gateway certificate, or disable the Authentication Override option in your GlobalProtect portal and gateway configuration entirely until you can upgrade.
• Lock down management exposure. Make sure GlobalProtect isn't inadvertently reachable through management-interface ports, and apply Interface Management profiles to restrict who can reach them.
• Rotate credentials and hunt. Given how quickly Unit 42 and Arctic Wolf both documented attackers moving from VPN access to domain-wide compromise, any organization that was running a vulnerable, exposed configuration should assume compromise is possible and hunt for the persistence and credential-theft techniques described above, not just apply the patch.

If your organization already runs a modern VPN architecture elsewhere and is weighing protocols for a redesign, it's worth understanding the tradeoffs; our comparison of WireGuard and OpenVPN covers how the two major protocols differ on security and performance. This isn't the first PAN-OS flaw to draw active exploitation this year, either — we covered a separate authentication-related PAN-OS vulnerability, CVE-2026-0322, earlier in 2026, and edge VPN appliances generally have had a rough year: Ivanti's Connect Secure platform faced its own pair of actively exploited CVEs that followed a similar pattern of delayed, sustained exploitation after disclosure.

Why this keeps happening to VPN edge devices

GlobalProtect, like other remote-access VPN gateways, sits at the network perimeter by design — reachable from the internet so remote employees can connect. That same property makes any authentication flaw in it unusually valuable to ransomware affiliates: a single bypass can hand over a foothold inside the network without needing to phish a single employee. Unit 42's own account of the intrusion chain — VPN access, then vCenter, then ESXi, then domain controller credential theft, then backup-infrastructure sabotage — illustrates why security teams increasingly treat "internet-facing VPN appliance" as one of the highest-value targets to patch fast and monitor closely, not a background utility that can wait for the next maintenance window.

What to do now

If you operate any PAN-OS GlobalProtect portal or gateway, or Prisma Access, treat CVE-2026-0257 as unfinished business rather than old news:

1. Verify your PAN-OS/Prisma Access version against Palo Alto's fixed-version list and patch immediately if you're behind.
2. If patching must wait, apply the certificate and Authentication Override mitigations today — not after the next change window.
3. Audit GlobalProtect and management-interface exposure, and review logs for sessions that don't show a normal login flow.
4. If you find anything suspicious, escalate to incident response immediately; Unit 42 and Arctic Wolf's case data both show this access chain can reach domain-wide ransomware encryption in a short window.
5. Subscribe to Palo Alto's own security advisory for CVE-2026-0257 and Unit 42's threat brief for further updates, since both have been revised repeatedly as exploitation has continued.

Written bySana Qureshi

Sana Qureshi runs the security and privacy desk. She reports on actively exploited vulnerabilities, vendor patches and data breaches, and covers the password managers, VPNs and authentication tools readers use to protect themselves. Her alerts cite vendor advisories, CISA and the CVE record directly.

More from Sana QureshiAll Security & Privacy coverage