A GlobalProtect authentication bypass patched in May is now a ransomware entry point. Unit 42 names Qilin and Inc affiliates among the users, and describes one intrusion that went from VPN to vCenter to a domain controller’s virtual disk.
What changed this week
CVE-2026-0257 is not new. Palo Alto Networks published the advisory on 13 May 2026. A public proof of concept followed on 29 May, the day CISA added it to the Known Exploited Vulnerabilities catalogue. What is new is who is using it.
In an update to its threat brief on 19 October, Unit 42 says it “continues to observe attempted exploitation of CVE-2026-0257 by ransomware operators including Spikey Scorpius (aka Qilin) and Tarnished Scorpius (aka Inc)”. It is also aware of public reporting tying exploitation to actors using Settra ransomware. A further update on 20 October added guidance on management interface exposure.
The bug
The flaw is an authentication bypass in the GlobalProtect portal and gateway. In Unit 42’s words, it “could allow unauthorized attackers to circumvent security controls and initiate virtual private network (VPN) connections.” Palo Alto rates it 7.8 (High) but sets its own urgency to Highest and marks exploit maturity as Attacked. Panorama and Cloud NGFW are not affected. Only firewalls with authentication override cookies enabled and a specific certificate configuration are vulnerable; the advisory explains how to check.
A score of 7.8 for “the wrong people can join your VPN” is one of those numbers best ignored.
What attackers do next
Unit 42’s investigations have run since early June across sectors from education and healthcare to government and utilities. Its description of the typical sequence is familiar: the VPN session is the foothold, with MFA bypassed, followed by reconnaissance using remote monitoring and management tools, lateral movement over RDP and SMB, then credential harvesting, exfiltration and ransomware.
The detail worth reading twice is the pivot to virtualisation. In one case, Unit 42 says, attackers moved from the VPN gateway to vCenter, disabled the execInstalledOnly control on ESXi hosts, and used a custom tool for “offline credential dumping directly against a domain controller’s virtual disk (VMDK)”. That route never touches the guest operating system, so endpoint detection inside the domain controller is bypassed. Unit 42 has also seen the access chained with exploits for Veeam backup servers, specifically CVE-2023-27532.
Fixed versions
| Branch | Fixed in |
|---|---|
| PAN-OS 12.1 | 12.1.4-h6, 12.1.7 |
| PAN-OS 11.2 | 11.2.4-h17, 11.2.7-h14, 11.2.10-h7, 11.2.12 |
| PAN-OS 11.1 | 11.1.4-h33, 11.1.6-h32, 11.1.7-h6, 11.1.10-h25, 11.1.13-h5, 11.1.15 |
| PAN-OS 10.2 | 10.2.7-h34, 10.2.10-h36, 10.2.13-h21, 10.2.16-h7, 10.2.18-h6 |
| Prisma Access | 11.2.7-h13, 10.2.10-h36 |
What to look for
Unit 42 publishes nine IP addresses for activity before the proof of concept: 23.128.228[.]6, 104.207.144[.]154, 146.19.216[.]119, 146.19.216[.]120, 146.19.216[.]125, 179.43.172[.]213, 185.195.232[.]139, 198.12.106[.]60 and 202.144.192[.]47. Search GlobalProtect logs for successful logins from them.
More useful now that the code is public, look for successful gateway-connected events from any source using the host IDs or device names aa:bb:cc:dd:ee:ff, 00:11:22:33:44:55, WINDOWS-LAPTOP-001, DESKTOP-GP01 or GP-CLIENT. Real laptops rarely carry a MAC address that looks like a keyboard exercise. Unit 42 also lists hard-coded values from the proof of concept: endpoint_os_version of “Microsoft Windows 10 Pro 64-bit” with an empty source_user_info.domain.
Treat any successful gateway-connected event matching these as an incident, not a curiosity.
What to do
- Upgrade to a fixed release from the table. If you have been sitting on this since May, the ransomware crews have caught up with you. Where authentication override cookies are in use, users will need to log in again once after the upgrade. Palo Alto says to upgrade every portal and gateway together; if you temporarily disabled strict cookie HMAC validation for a phased upgrade, re-enable it once all of them are on a fixed version.
- Hunt back to May, not just to this week, using the indicators above. Prioritise successful sessions over failed probes.
- Check your management interface. During its Lunar Peak investigations, Unit 42 found organisations had mapped GlobalProtect profiles to HTTP/HTTPS services on management interfaces, exposing them on ports 4443 and 3879, “often without administrators’ knowledge”. Test from outside and restrict the Interface Management profile.
- Assume the next hop is your hypervisors and backups. Review vCenter logins, ESXi configuration changes such as
execInstalledOnly, and confirm Veeam is patched againstCVE-2023-27532. - Read the advisory’s workarounds if you cannot patch today, and treat them as a stopgap.
What to tell the board
A firewall bug from May, with a fix and a KEV entry since May, is now used by at least two established ransomware operations. The question is not whether the firewall was patched eventually, but whether anyone looked at who connected before it was. The vCenter route also means endpoint coverage figures say little about whether domain credentials are safe.
For another ransomware crew defenders are tracking now, see the joint advisory on SafePay. More is in Threats & Vulnerabilities.