Palo Alto Networks GlobalProtect Authentication Bypass — Ransomware Groups Actively Exploiting

🔴 CRITICAL — PATCH IMMEDIATELY: CVE-2026-0257 is an authentication bypass vulnerability in Palo Alto Networks GlobalProtect portal and gateway affecting PAN-OS and Prisma Access deployments.

The vulnerability allows unauthenticated remote attackers to bypass security restrictions and establish unauthorized VPN connections, gaining direct access to internal corporate networks. Ransomware groups Qilin and Settra are actively exploiting CVE-2026-0257 in the wild to gain stealthy VPN access for credential theft, lateral movement, and ransomware deployment. CISA added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog on May 29, 2026, with a federal remediation deadline of June 1, 2026 — this deadline is PAST DUE.

Exploitation presents significant detection challenges because attackers connect through the organization's own VPN, making their traffic appear as normal remote work. All organizations running vulnerable PAN-OS or Prisma Access deployments must patch immediately and audit for unauthorized VPN sessions.

overview

CVE-2026-0257 is a high-severity (CVSS 7.8) authentication bypass vulnerability in the GlobalProtect portal and gateway components of Palo Alto Networks PAN-OS and Prisma Access. The vulnerability allows unauthenticated remote attackers to bypass GlobalProtect authentication restrictions and establish unauthorized VPN connections without valid credentials.

GlobalProtect is Palo Alto Networks' primary remote access VPN solution, built into PAN-OS firewalls and delivered as a cloud service through Prisma Access. GlobalProtect is widely deployed by enterprises to provide secure remote access to internal systems, applications, and corporate networks. The vulnerability affects specific PAN-OS versions (12.1, 11.2, 11.1, 10.2) and Prisma Access versions (11.2, 10.2) when authentication override cookies are enabled alongside a specific certificate configuration. NOT affected: Panorama appliances or Cloud NGFW.

Palo Alto Networks disclosed this vulnerability on May 13, 2026. CISA added CVE-2026-0257 to its Known Exploited Vulnerabilities catalog on May 29, 2026, with a federal civilian agency remediation deadline of June 1, 2026. Ransomware groups including Qilin and Settra are actively exploiting this vulnerability in the wild to gain unauthorized VPN access for stealthy network intrusions, credential theft, and ransomware deployment. Organizations have had over four months to remediate; any unpatched systems represent active risk.

attack fLOW AND TECHNICAL DETAILS

Vulnerability Root Cause (Authentication Override Cookie Trust Boundary Bypass):

The vulnerability stems from improper validation and integrity checking of authentication override cookies in GlobalProtect portal and gateway components. Authentication override cookies are a feature designed to reduce the number of times users must authenticate when accessing GlobalProtect portal and gateway, or entering repeated OTPs. The vulnerable components trust authentication override cookies without performing proper validation of cookie integrity, origin, or legitimacy. This allows attackers to craft or obtain authentication override cookies and use them to bypass the normal GlobalProtect authentication process without providing valid user credentials. The vulnerability specifically affects configurations where (1) GlobalProtect portal or gateway is configured with authentication override cookie generation/acceptance enabled, AND (2) a specific vulnerable certificate configuration is present.

Affected Products & Versions:

Exploitation Scenario (CVE-2026-0257):

1. Target Identification: Attacker identifies internet-exposed Palo Alto GlobalProtect portal or gateway (via port scanning, Shodan, passive reconnaissance). GlobalProtect appliances are typically accessible on ports 443 or 10443 on internet-facing edge devices.
2. Vulnerability Detection: Attacker determines if target runs vulnerable PAN-OS or Prisma Access version and if authentication override cookies are enabled. May use public indicators of compromise or PoC scripts to verify vulnerability.
3. Authentication Bypass Exploitation: Attacker crafts or obtains authentication override cookies and sends them to vulnerable GlobalProtect portal/gateway. The vulnerable component fails to properly validate cookie integrity/origin and accepts the malicious cookies.
4. Unauthorized VPN Session Establishment: Attacker successfully bypasses GlobalProtect authentication and establishes unauthorized VPN session WITHOUT providing valid user credentials. From attacker's perspective, they now have a legitimate-appearing VPN connection to internal corporate network.
5. Stealthy Network Access: Attacker gains access to internal corporate network resources accessible through VPN. Traffic appears as normal remote-work VPN traffic, difficult to distinguish from legitimate users. This gives attackers significant time to perform reconnaissance, move laterally, and steal credentials.
6. Credential Theft & Lateral Movement: Attacker uses VPN access to harvest credentials from compromised systems, pivot to internal systems, and establish persistence. In documented cases, attackers deployed Cobalt Strike, BloodHound, and SharpHound for reconnaissance and lateral movement.
7. Ransomware Deployment: Based on exploitation history, attackers use compromised network access to conduct ransomware reconnaissance, deploy encryption tools, and execute ransomware across multiple systems for extortion.

Attack Prerequisites (CVE-2026-0257):

• Network access to GlobalProtect portal or gateway (internet-exposed)
• NO authentication credentials required (unauthenticated attack)
• NO user interaction required
• Low attack complexity — no special tools or techniques needed
• Target must have authentication override cookies enabled AND vulnerable certificate configuration

threat actor and EXPLOITATION HISTORY

Active Ransomware Group Exploitation:

• Qilin Ransomware Group: Documented exploiting CVE-2026-0257 to establish unauthorized VPN access, harvest credentials, and deploy Qilin ransomware. ReliaQuest reports show Qilin using compromised VPN access for reconnaissance with BloodHound/SharpHound, then ransomware deployment.
• Settra Ransomware Group: ReliaQuest threat updates identify Settra as secondary threat group actively exploiting CVE-2026-0257 alongside Qilin for stealthy VPN access and network intrusion.
• Exploitation Timeline: Vulnerability disclosed May 13, 2026. CISA added to KEV catalog May 29, 2026 with federal deadline June 1, 2026. Exploitation confirmed in the wild by late May/early June 2026. Continues through October 2026 (present day) against unpatched systems.
• Post-Compromise Tools: Documented use of Cobalt Strike (C2 framework), BloodHound/SharpHound (internal reconnaissance), and native Windows tools for lateral movement and persistence.
• Detection Challenge: Attackers use legitimate VPN sessions to access internal networks. Their traffic appears as normal remote-work VPN activity. This evasion technique gives attackers significant dwell time for reconnaissance and attack preparation before security teams detect unauthorized activity.

Why VPN Gateways Are High-Value Targets: GlobalProtect is a trusted remote access service. Compromising it provides direct access to corporate networks, trusted status in detection systems, and appearance of legitimate user activity. Ransomware groups specifically target VPN gateways as initial access vector for network-wide ransomware deployment.

potential impact

• Unauthorized VPN Access: Unauthenticated attackers bypass GlobalProtect authentication and establish VPN sessions without valid credentials. Complete compromise of VPN trust boundary.
• Internal Network Access: Once authenticated through VPN, attackers gain access to all resources and systems accessible through the VPN (internal workstations, servers, file shares, databases, application servers).
• Credential Theft: Attackers perform reconnaissance with BloodHound/SharpHound to identify high-value targets and credentials. Use network access to harvest credentials from systems, domain controllers, or credential storage locations.
• Lateral Movement & Privilege Escalation: Stolen credentials enable lateral movement to additional systems. Attackers move from compromised workstations to servers, administrative systems, or critical infrastructure.
• Ransomware Deployment: Based on exploitation history, attackers use compromised network access to conduct reconnaissance, identify critical systems, stage ransomware across the network, and execute simultaneous encryption across multiple systems for maximum impact and extortion leverage.
• Data Exfiltration: Attackers access internal file shares, databases, or application data through compromised network and exfiltrate sensitive information for theft or sale on dark web.
• Persistent Backdoor Access: Attackers establish persistence mechanisms (backdoor accounts, webshells, scheduled tasks) to maintain access even after VPN vulnerability is patched.
• Compliance Violation & Breach Notification: Unauthorized access to corporate network may expose personal data, intellectual property, or regulated information (PII, PCI, HIPAA, etc.), triggering breach notification and regulatory penalties.
• Business Continuity Risk: Ransomware deployment can encrypt critical systems, halt business operations, disrupt supply chain, and create extortion demands. RTO/RPO severely impacted during incident response.

indicators of compromise

VPN Access Log Indicators:

• GlobalProtect VPN sessions from unexpected source IP addresses (particularly non-corporate ISPs, VPN providers, or TOR exit nodes)
• VPN logins without corresponding authentication log entries (authentication bypass indicator)
• VPN sessions from unfamiliar usernames or administrative-sounding accounts (generic names, service accounts, default accounts)
• Multiple VPN session failures followed by successful session (credential guessing or bypass attempt followed by success)
• VPN sessions established outside normal business hours or from unusual geographies
• VPN sessions with hostnames such as "kali", "pentester", or other suspicious device names (post-exploitation reconnaissance platform)

Network Traffic Indicators:

• Unusual outbound network traffic from VPN-connected IP addresses to internal systems (reconnaissance or lateral movement)
• Connections from VPN session to internal servers running BloodHound/SharpHound or network scanning tools
• High volume of SMB, LDAP, or RDP traffic from VPN-connected IP addresses (lateral movement indicators)
• Cobalt Strike beacon C2 traffic from VPN-connected systems
• Unexpected PowerShell or command-line activity over RDP from VPN-connected sessions

System & Application Logs:

• Failed authentication attempts to domain controllers or critical systems followed by successful logins from VPN-connected IP
• File server access logs showing unusual file access or mass data transfer from VPN-connected IP
• Windows event logs showing remote code execution or process creation from VPN-connected systems
• Domain controller logs showing suspicious Kerberos ticket generation or privilege escalation events from VPN-connected IP
• Ransomware artifacts (encrypted file extensions, ransom notes, suspicious processes) on systems accessed from VPN session

monitoring and telemetry

• VPN Access Logging & Monitoring: Enable comprehensive GlobalProtect access logging capturing VPN session source IP, username, authentication method, timestamp, session duration, and termination. Monitor for sessions without corresponding authentication log entries (bypass indicator). Alert on VPN logins from unexpected IPs, suspicious hostnames, or outside business hours. Review VPN audit logs continuously for unauthorized sessions.
• Post-VPN Network Behavior Monitoring: Monitor network behavior of VPN-connected systems. Alert on VPN sessions showing reconnaissance activity (port scanning, service enumeration), lateral movement (SMB/RDP/SSH connections to internal systems), or suspicious process execution. This is critical because traffic appears legitimate but attacker behavior reveals compromise.
• Authentication Event Monitoring: Monitor for VPN authentication events without corresponding user actions. Compare VPN session logs against active directory logins and user workstation activity. Flag VPN sessions from accounts not matching normal remote worker patterns.
• Intrusion Detection / Prevention (IDS/IPS): Deploy network signatures detecting CVE-2026-0257 exploitation attempts or post-exploitation tools (Cobalt Strike, BloodHound signatures). Monitor for authentication bypass patterns in GlobalProtect traffic.
• Endpoint Detection & Response (EDR): Deploy EDR on systems accessible through VPN. Monitor for suspicious process execution, credential access, lateral movement tools (BloodHound/SharpHound), and ransomware indicators from VPN-connected systems. EDR should correlate VPN access logs with endpoint activity.
• Lateral Movement Detection: Monitor for lateral movement signatures: abnormal SMB traffic, RDP sessions from VPN-connected IPs to servers, LDAP queries, PowerShell remoting, or pass-the-hash attacks. Alert on reconnaissance activity (BloodHound/SharpHound) from VPN-connected systems.
• Vulnerability Scanning & Assessment: Regularly scan GlobalProtect portals and gateways to verify patching status. Test for CVE-2026-0257 vulnerability using public PoC scripts. Validate that authentication override cookies are disabled if not business-critical.
• Threat Intelligence Integration: Subscribe to threat feeds covering CVE-2026-0257 exploitation indicators, ransomware group TTPs, and post-exploitation tool signatures. Monitor for Qilin and Settra ransomware activity.

compliance impact

PCI DSS: Requirement 8.1 (authentication) — unauthorized VPN access violates authentication requirement. Requirement 10 (logging and monitoring) — adequate monitoring must detect VPN anomalies. Requirement 6.2 (patches) — unpatched CVE-2026-0257 represents control failure. CISA deadline was June 1, 2026; any still-unpatched systems are audit findings.

HIPAA: 45 CFR §164.308(a)(5)(ii)(C) (monitoring) — unauthorized VPN access must be detected. §164.312(a)(2)(i) (access controls) — compromise through bypass represents control failure. Unauthorized access to ePHI requires breach notification within 60 days to affected individuals and authorities.

SOX: Section 404 (internal control over financial reporting) — unpatched critical VPN vulnerability represents control deficiency. Section 302 (CEO/CFO certification) — failure to remediate known-exploited vulnerability within federal deadline indicates management did not maintain adequate IT controls over financial reporting systems.

GDPR: Article 32 (security of processing) — unpatched authentication bypass vulnerability indicates failure to implement appropriate technical measures protecting personal data. Article 33 (breach notification) — unauthorized access to systems containing personal data requires notification to supervisory authority within 72 hours.

ISO/IEC 27001: A.14.1 (secure development) — authentication bypass in access control represents application security failure. A.12.4.1 (logging) — inadequate monitoring to detect VPN compromise represents logging gap. A.13.1.1 (network perimeter) — VPN authentication bypass indicates perimeter control failure. Unpatched known-exploited vulnerability violates A.12.6.1 (security patch management).

NIST CSF: Protect (PR.AC-1, PR.AC-4, PR.AC-6) — access controls must prevent unauthorized VPN authentication. Detect (DE.CM) — monitoring must detect unauthorized VPN access and post-compromise behavior. Respond (RS) — incident response procedures must address VPN gateway compromise. Unpatched known-exploited vulnerability represents preventive control failure across multiple framework functions.

recommendations

IMMEDIATE ACTIONS (Today — within 4 hours):

• Inventory GlobalProtect Deployments: Identify all Palo Alto GlobalProtect portals and gateways in your environment. Document PAN-OS and Prisma Access versions, deployment topology, certificate configurations, and network exposure (internet-facing, behind firewall, etc.).
• Verify Patch Status: Check current PAN-OS/Prisma Access versions against Palo Alto's fixed version table. Determine which appliances are vulnerable to CVE-2026-0257. Note: CISA deadline was June 1, 2026 — any still-unpatched systems are severely overdue.
• Threat Hunt for Current Exploitation: Review GlobalProtect access logs for unauthorized VPN sessions. Look for: VPN logins without authentication logs, sessions from suspicious IPs/hostnames, sessions outside business hours, sessions with generic or admin-sounding usernames. Review network traffic for post-exploitation indicators (Cobalt Strike, BloodHound, lateral movement). Review Windows event logs for suspicious authentication or process execution from VPN-connected systems.
• Terminate Active Sessions (Immediate): Kill all active GlobalProtect VPN sessions. Force re-authentication after patching. This terminates any unauthorized sessions established through CVE-2026-0257 exploitation.
• Audit Authentication Override Cookies Configuration: For each GlobalProtect portal/gateway: navigate to Authentication → Authentication Override to verify current configuration. Check whether "Generate cookie for authentication override" and "Accept cookie for authentication override" are enabled. If not business-critical, disable these features immediately.
• Download Patches: Download latest PAN-OS/Prisma Access hotfixes from Palo Alto support portal. Verify checksums and digital signatures. Prioritize internet-exposed appliances.

SHORT-TERM ACTIONS (Same day — within 24 hours for internet-exposed appliances):

• Apply Security Patches: Deploy hotfixes to all vulnerable GlobalProtect appliances immediately, prioritizing internet-exposed portals/gateways. Test patches in non-production environment first. Schedule maintenance windows considering redundancy and failover. Ensure hybrid Prisma Access deployments have both cloud and on-premises components patched for cookie compatibility.
• Certificate Configuration Hardening: As part of patching, ensure GlobalProtect is configured with a certificate dedicated exclusively for authentication override cookies (not reused from portal/gateway certificate or other services). Palo Alto specifically warns against certificate reuse.
• Disable Unnecessary Authentication Override Cookies: If authentication override cookies are not business-critical for your deployment, disable the feature entirely after patching. This eliminates the attack surface entirely.
• Verify Patch Installation: After patching each appliance, verify updated version is running. Confirm GlobalProtect portal/gateway services are functioning. Verify no regressions introduced. Users will be required to re-authenticate once after patching (expected behavior).
• Forensic Investigation (if Exploitation Indicators Found): If threat hunt discovers unauthorized VPN sessions, suspicious traffic, or system compromise: activate incident response. Preserve all access logs, network traffic captures, system logs for forensic analysis. Determine scope: how many systems compromised, which credentials stolen, what data accessed, how long attackers had access.
• Enable Comprehensive GlobalProtect Logging: Ensure detailed GlobalProtect access logging is enabled and retained for 90+ days minimum. Capture source IP, username, timestamp, session duration, termination reason. This is essential for detecting future compromise attempts.

ONGOING GOVERNANCE:

• VPN Access Monitoring & Alerting: Deploy 24/7 monitoring of GlobalProtect access logs. Alert on sessions from unexpected IPs, suspicious hostnames, or outside business hours. Correlate VPN access with endpoint activity to detect post-exploitation behavior (reconnaissance, lateral movement).
• Post-VPN Network Behavior Monitoring: Monitor for suspicious activity from VPN-connected systems: port scanning, service enumeration, lateral movement, credential access, or reconnaissance tools. This detection is critical because traffic appears legitimate but attacker behavior reveals compromise.
• Vulnerability Scanning & Patch Management: Establish expedited patching timeline for critical VPN vulnerabilities (target: 24 hours for internet-exposed appliances, 72 hours for internal-only). Maintain inventory of all GlobalProtect versions. Conduct regular vulnerability scans to verify patching status and identify misconfigurations.
• Network Segmentation & Access Control: Implement network segmentation restricting VPN-connected systems' access to only necessary internal resources. Prevent VPN from directly accessing sensitive databases, administrative interfaces, or critical infrastructure without additional controls. Monitor and alert on access outside approved whitelist.
• Multi-Factor Authentication (MFA): Require MFA for all GlobalProtect access, especially administrative access to portals/gateways. MFA prevents attackers from using compromised credentials to establish new VPN sessions.
• Threat Intelligence & Ransomware Monitoring: Subscribe to threat feeds for CVE-2026-0257 indicators and Qilin/Settra ransomware activity. Monitor for exploitation signatures or indicators of post-compromise behavior. Maintain awareness of VPN-targeting threat actor campaigns.
• Incident Response Readiness: Maintain incident response procedures for VPN gateway compromise. Define escalation paths, forensic capabilities, breach notification process. Conduct tabletop exercises for VPN security incidents. Plan for potential ransomware deployment scenario post-VPN compromise.
• Regular Security Assessment: Conduct quarterly vulnerability assessments of GlobalProtect deployments. Test for CVE-2026-0257 and other known-exploited vulnerabilities using public PoC tools. Perform annual penetration testing of remote access infrastructure.

SUPPORTING DOCUMENTATION

• Palo Alto Networks Security Advisory — CVE-2026-0257
• NIST NVD — CVE-2026-0257 Vulnerability Details
• CISA Alert — CVE-2026-0257 Active Exploitation
• CISA Known Exploited Vulnerabilities Catalog (KEV)
• CWE-565 — Reliance on Cookies without Validation and Integrity Checking
• OWASP — Authentication Bypass Attack