What happened

A GlobalProtect bug that Palo Alto Networks patched on May 13 has become a way in for ransomware crews. On October 19, the company's Unit 42 team updated its threat brief on CVE-2026-0257 to name two of them: Spikey Scorpius, better known as Qilin, and Tarnished Scorpius, better known as Inc. The brief also cites public reporting that ties a third group, using Settra ransomware, to the same flaw. Unit 42 repeats that attribution without confirming it.

The update was republished on October 20, and Help Net Security picked it up on October 21. Unit 42 says its investigations have been running since early June, across 11 sectors: education, financial services, healthcare, high technology, hospitality, manufacturing, professional and legal services, government, transportation and logistics, utilities and energy, and wholesale and retail.

This is not a zero-day. The fix has been out for five months. The victims are organisations that had not installed it, or had not applied the workaround, when the attackers arrived.

Why it matters

The attacker ends up with a working VPN session into the corporate network, and never needs a username or a password to get it. Unit 42 describes attackers "subsequently bypassing multi-factor authentication (MFA) controls to establish a VPN session." To the firewall that looks like an ordinary remote worker connecting. MFA, the control most companies count on to stop a stolen password, never gets a chance to fire.

The story has also changed. When Rapid7 first saw exploitation on May 17, four days after the patch, with a second wave on May 21, it reported no sign of successful lateral movement. Palo Alto's own advisory spoke of "limited exploit attempts." By October, the same access is the first step of full ransomware intrusions.

How the bypass works

GlobalProtect can issue authentication override cookies, so a user who has already signed in is not asked again. The problem appears when those cookies are encrypted with the same certificate the portal or gateway uses for HTTPS. That certificate's public key is handed to every visitor in the TLS handshake. Rapid7 put it bluntly: "anyone who knows the public key for the certificate used by the authentication override feature to encrypt and decrypt cookies, can successfully forge and encrypt an arbitrary authentication override cookie."

So the attacker forges a cookie, presents it, and the gateway lets them in. CISA added the bug to its Known Exploited Vulnerabilities catalog on May 13, and a public proof-of-concept followed on May 29. That made the attack available to anyone, not just the groups that worked it out first.

Palo Alto rates it 7.8 (HIGH) under CVSS v4.0, not critical, but sets its own "Suggested Urgency" to HIGHEST. Only one setup is exposed: a GlobalProtect portal or gateway with "Generate cookie for authentication override" or "Accept cookie for authentication override" turned on, plus the shared certificate configuration. Panorama and Cloud NGFW are not affected.

Inside the intrusions

Once on the VPN, the attackers in Unit 42's cases scouted the network with dual-use remote monitoring and management (RMM) tools, moved sideways over RDP and SMB, and staged tools for credential theft, data exfiltration and ransomware.

The change Unit 42 flags as most significant is a "direct pivot to the virtualization layer." In one case the attackers went from the VPN gateway straight to the vCenter management appliance, switched off the execInstalledOnly protection on the ESXi hypervisors, and ran a custom tool to dump credentials offline from a domain controller's virtual disk (VMDK). Reading the disk from underneath means the endpoint security software running inside Windows never sees it. Some attackers also chained the access with an old Veeam backup flaw, CVE-2023-27532.

Arctic Wolf Labs saw the same pattern earlier. Its July 20 report covers several June intrusions that started with CVE-2026-0257 and ended with Qilin ransomware. The toolkit was familiar: LSASS memory dumps through rundll32 and comsvcs.dll, NTDS extraction with ntdsutil, PsExec, AnyDesk, Ngrok and LogMeIn for remote access, and Rclone to copy data to MEGA. Payloads, often named win.exe, were staged in C:\PerfLogs. Some attackers encrypted within hours. Others spent a long time looking around first.

Fixed versions

These are the releases listed in the Palo Alto advisory, checked on October 22, 2026 (the advisory was last updated June 3).

If you cannot upgrade today, the advisory offers two workarounds: give authentication override cookies their own dedicated certificate, separate from the portal and gateway certificate, or switch authentication override off entirely.

What to do now

Patching closes the door but does not tell you whether someone already walked through it. Unit 42's cases go back to early June, so hunt the GlobalProtect logs at least that far. Unit 42 says to treat any successful gateway-connected event with a suspicious host ID or device name as an incident. Its list includes aa:bb:cc:dd:ee:ff, 00:11:22:33:44:55, WINDOWS-LAPTOP-001, DESKTOP-GP01 and GP-CLIENT. It also lists the proof-of-concept's hard-coded values: an endpoint_os_version of "Microsoft Windows 10 Pro 64-bit" with an empty source_user_info.domain. The attacker IP addresses are in the brief itself.

Arctic Wolf adds a few more checks. Look for VPN sessions coming from hosting providers or from hostnames containing "kali". Watch C:\PerfLogs for new executables. Alert on Windows Event ID 1102, which means the audit log was cleared. If you find signs of a break-in, rotate every domain credential, because LSASS and NTDS dumps mean the attackers left with all of them.

Unit 42 also flags a separate misconfiguration. Mapping GlobalProtect profiles to the HTTP/HTTPS services on the management interface puts that interface on the internet on ports 4443 and 3879. Try an HTTPS connection to the management IP on those ports from outside your network. If it answers, fix that too.

What's next

A public exploit, a five-month-old patch and two established ransomware brands is a mix that rarely fades on its own. Edge VPN appliances have been a favourite way in for ransomware for years, and Unit 42's note about going straight to vCenter suggests these crews are getting faster at turning one VPN session into the whole estate. Unit 42 has kept updating its brief since May, so check it for new indicators. If your firewall uses authentication override cookies and still runs an unpatched build, assume it has been probed and start the log hunt today.