Ransomware Gangs Are Exploiting Palo Alto GlobalProtect Flaw CVE-2026-0257

At least three ransomware operations are breaking into networks through CVE-2026-0257, an authentication bypass in the GlobalProtect portals and gateways of Palo Alto Networks' PAN-OS firewalls. The company's Unit 42 has tied intrusions to the Qilin and Inc gangs since early June. Exploitation began earlier: Rapid7 saw its first case on 17 May.

Palo Alto published the fix on 13 May and says the attempts it knows of hit unpatched devices without mitigations applied.

The flaw

PAN-OS trusts an authentication override cookie it can decrypt without properly checking that the firewall issued it. A portal or gateway is exposed when authentication override cookies are enabled and a specific certificate configuration exists; Panorama and Cloud NGFW aren't affected. Palo Alto first rated it 4.7, medium, and raised it to 7.8 on 29 May. CISA added it to its Known Exploited Vulnerabilities catalogue the same day.

Who is using it

Rapid7 saw attackers log in as the local admin account with forged cookies at several of its customers. Unit 42 lists victims in eleven sectors, including government, healthcare and education. Settra ransomware operators have used the flaw as well, ReliaQuest's threat researchers said on X.

What the attackers do next

Unit 42's write-up gives the chain: bypass multi-factor authentication to open a VPN session, scout the network with remote management tools, move over RDP and SMB, then stage tools for credential theft, data exfiltration and ransomware. In one case the attackers pivoted from the VPN gateway to a VMware vCenter appliance, disabled security controls on ESXi hosts and dumped credentials offline from a domain controller's virtual disk, which kept them out of reach of in-guest EDR. Some actors also chained the access with exploits for CVE-2023-27532 in Veeam backup software.

What to do

1. Patch PAN-OS to the fixed build for your branch in Palo Alto's advisory: 12.1.4-h6 or 12.1.7 and later on 12.1, 11.2.12 or later on 11.2, 11.1.15 or later on 11.1, 10.2.18-h6 or later on 10.2, or a hotfix the advisory lists for your release. Palo Alto is upgrading Prisma Access for customers on a schedule it shares with them.
2. If you can't patch yet, apply the advisory's workaround: give authentication override cookies a dedicated certificate that nothing else uses, or turn off the generate and accept cookie options on the portal and gateway.
3. Review VPN logs from 13 May onward for sessions you can't account for, especially ones that skipped MFA.
4. Hunt for what comes after: RDP and SMB from VPN address ranges, new accounts, access to vCenter and ESXi management, and changes to backup servers.
5. Patch Veeam if CVE-2023-27532 is still open on your backup infrastructure.
6. Check your logs against the IP addresses and host names listed in Unit 42's indicators.