Palo Alto Networks has confirmed exploitation attempts against CVE-2026-0257 in GlobalProtect, and in a threat brief dated 20 October 2026 the Unit 42 team describes ransomware operators using the flaw for initial access to corporate networks. It lets an attacker reach the VPN without valid credentials and get around multi-factor authentication. A fix has been available since May 2026 and only some configurations are exposed, so the check takes a few minutes.
What happened
PAN-OS is the operating system of Palo Alto Networks firewalls, and GlobalProtect is the part that gives employees VPN access to the corporate network. The flaw is that the portal and the gateway trust an authentication override cookie without validating its integrity (CWE-565). An attacker on the network, without authentication and without any user interaction, can therefore establish an unauthorised VPN connection. The vendor rates the flaw CVSS 4.0 7.8 (high), while marking urgency as highest and exploit maturity as attacked.
What makes it worse is what follows. According to Unit 42, the flaw serves as an entry point for ransomware operations. The groups Unit 42 tracks as Spikey Scorpius (also known as Qilin) and Tarnished Scorpius (Inc) connect to the VPN, survey the internal network with common remote management tools, move laterally over RDP and SMB, harvest credentials, exfiltrate data and finally deploy ransomware. Public reporting also attributes exploitation to actors using Settra ransomware. In one case the attackers pivoted straight from the VPN gateway to the virtualisation layer: they reached the vCenter appliance, disabled the execInstalledOnly control on ESXi hosts and dumped credentials from the virtual disk of a domain controller offline, so protection running inside the servers had nothing to record. Unit 42 investigations have been running since June 2026 and span financial services, healthcare, manufacturing, transport, energy and government.
Does this affect you?
Affected are firewalls running PAN-OS 10.2, 11.1, 11.2 and 12.1 below the fixed versions listed in the vendor advisory, and Prisma Access environments. Panorama and Cloud NGFW are not affected.
Three conditions must hold at the same time: a GlobalProtect portal or gateway is configured, authentication override cookies are enabled, and a specific certificate configuration protects those cookies. The vendor advisory describes how to check whether the cookies are in use:
- On the portal: Network, GlobalProtect, Portals, your portal, the Agent tab, your agent configuration profile, the Authentication tab. Check whether Generate cookie for authentication override or Accept cookie for authentication override is ticked.
- On the gateway: Network, GlobalProtect, Gateways, your gateway, the Agent tab, the Client Settings profile, the Authentication Override tab, the Accept cookie for authentication override option.
What to do now
- Update PAN-OS to the fixed release for your branch. The vendor lists 12.1.7 or 12.1.4-h6, then 11.2.12, 11.2.10-h7, 11.2.7-h14 or 11.2.4-h17, for the 11.1 branch version 11.1.15 or the matching hotfix, and for the 10.2 branch version 10.2.18-h6 or the matching hotfix. The target release for your exact build is in the Palo Alto Networks advisory for CVE-2026-0257.
- Prisma Access: 11.2.7-h13 and 10.2.10-h36 respectively. The vendor states that it upgrades customer environments according to the agreed schedule.
- Expect that after the upgrade the cookie is generated in a more secure way and GlobalProtect users will have to authenticate once more. This is a one time step, so tell them in advance.
- If you cannot update immediately, disable authentication override cookies or use a dedicated certificate for them.
- After the upgrade, end existing VPN sessions so that nobody continues on an old cookie.
- Check whether GlobalProtect has exposed your management interface to the internet. Unit 42 points to a recurring misconfiguration where GlobalProtect profiles are mapped to HTTP and HTTPS services on the management interface, which then becomes reachable on ports 4443 and 3879. You can verify it by attempting an HTTPS connection to the management address from the internet.
How to tell whether you are already compromised
Unit 42 published a list of indicators in its threat brief, including IP addresses seen before the public exploit was released. The approach is as follows:
- In GlobalProtect logs, look for successful cookie based logins from IP addresses you would not expect for your users.
- Look for successful gateway-connected events with suspicious device identifiers or machine names, for example generic MAC addresses or names such as GP-CLIENT.
- The public exploit has client configuration values hard coded. Connections reporting the operating system as Microsoft Windows 10 Pro 64-bit with no user domain are therefore suspicious.
- If you find such a connection, start your incident response process and review the virtualisation layer as well: access to vCenter, changes to ESXi settings and downloads of VMDK disks.
Not able to keep track of this?
Edge devices need continuous attention, not a quarterly review. We help organisations decide who watches vendor advisories, how patching decisions are made and what happens when a fix cannot be deployed at once. Have a look at security leadership or a security assessment, or write to us through our contact page. The initial consultation is free of charge. If you are dealing with an incident right now, see the under attack page.
We covered a different PAN-OS flaw, CVE-2026-0322 in the management interface, in our vulnerability roundup for 12 to 16 October 2026.
Sources: Palo Alto Networks, advisory for CVE-2026-0257 with affected and fixed versions · Unit 42, threat brief on exploitation of CVE-2026-0257 and indicators · CISA, Known Exploited Vulnerabilities catalogue