A vulnerability in Palo Alto Networks’ GlobalProtect VPN software that has been exploitable since at least May 2026 is now being actively used by ransomware groups to break into corporate networks, according to a threat brief that the company’s Unit 42 research team updated on October 19 and 20.
The flaw, tracked as CVE-2026-0257, is an authentication bypass in the GlobalProtect portal and gateway. Palo Alto Networks’ own advisory describes it as a problem with “insufficient validation and integrity checking of authentication override cookies” on systems running a specific certificate configuration. In practical terms, an attacker who can reach a vulnerable GlobalProtect portal can establish a VPN session without ever supplying a valid username, password, or multi-factor authentication code, landing on the network with the same access as a legitimate remote employee.
Palo Alto Networks rates the bug 7.8 on the CVSS 4.0 scale, a high rather than critical score, but the company’s own scoring data flags that exploitation has already been observed in the wild. The vulnerability affects PAN-OS versions 10.2, 11.1, 11.2 and 12.1, along with some Prisma Access deployments, if they are running releases older than the patched point versions Palo Alto Networks published alongside the advisory. Panorama and Cloud NGFW are not affected. The company first published its advisory on May 13, 2026, the same day the bug was added to the US Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalog, and proof-of-concept exploit code began circulating publicly on May 29.
Unit 42 said its investigations into real-world attacks using the flaw began in early June and have continued since, spanning victims in education, financial services, healthcare, government, and the utilities and energy sector. In the cases Unit 42 reviewed, attackers used the authentication bypass purely to get a foothold, then moved on to internal reconnaissance using legitimate remote monitoring and management tools, lateral movement over RDP and SMB, and eventually credential theft, data exfiltration and the deployment of ransomware. In one incident, the attackers pivoted from the compromised VPN gateway to a VMware vCenter appliance, disabled its built-in security controls, and pulled credentials offline directly from a domain controller’s virtual disk file, a technique that tends to avoid the alerts that live credential-dumping tools often trigger. Unit 42 also said some of the same intrusions chained this access with a separate, older flaw in Veeam backup software, tracked as CVE-2023-27532.
Unit 42 attributed the exploitation it tracked to two ransomware-linked clusters it calls Spikey Scorpius, which it associates with the Qilin ransomware operation, and Tarnished Scorpius, which it associates with the group known as Inc. Separately, incident response firm ReliaQuest has published its own reporting tying exploitation of the same flaw to attackers deploying ransomware it calls Settra. Qilin in particular has been one of the most active ransomware-as-a-service operations of the past two years, and a working, unauthenticated way into corporate VPNs would be a valuable addition to any affiliate’s toolkit.
Palo Alto Networks’ advisory lists specific patched builds for each affected PAN-OS and Prisma Access branch. Organizations that cannot patch immediately are advised to either configure a certificate used exclusively for authentication override cookies, rather than reusing a general-purpose certificate, or to disable the Authentication Override feature in their GlobalProtect portal and gateway configuration until they can update. Given that this flaw has now had roughly five months of real-world exploitation and public proof-of-concept code, any organization still running an unpatched, affected version should treat this as an urgent patching job rather than a routine one.
Source: Palo Alto Networks Unit 42.
