Ransomware Actors Weaponize Palo Alto GlobalProtect Authentication Bypass for Stealthy VPN Access

CVE-2026-0257 lets attackers forge authentication cookies and walk into corporate networks through the VPN itself. Qilin and Settra ransomware operations are already doing it.

TL;DR

CVE-2026-0257 is a high-severity authentication bypass in Palo Alto Networks’ GlobalProtect VPN, and ransomware operators are exploiting it. An unauthenticated attacker can forge an authentication override cookie and get a fully authorized VPN session without valid credentials. From the network’s point of view, the intruder is just another remote user.

ReliaQuest’s threat intelligence update of October 11, 2026 confirms that several groups use the flaw to open unauthorized VPN sessions and move laterally through internal networks. They include the Qilin ransomware-as-a-service (RaaS) operation and a newer variant called Settra. Exploitation began in mid-May 2026 and has since grown into ransomware deployments across multiple industry sectors.

The vulnerability

Root cause

CVE-2026-0257 is classified as CWE-565: Reliance on Cookies without Validation and Integrity Checking. It sits in GlobalProtect’s Authentication Override feature, which hands authenticated users an encrypted cookie that works as a bearer token on later connections.

The flaw is in the main_DecryptAppAuthCookie function of the gpsvc binary. When a cookie arrives, the appliance base64 decodes it, decrypts it with the configured private key, and then trusts whatever came out. Nothing verifies a signature. Rapid7’s analysis puts it this way: “the incoming encrypted cookie is base64 decoded and then decrypted using a private key. The decrypted content is then trusted implicitly, with no signature verification of any kind occurring after decryption”. Anyone who holds the matching public key can therefore forge a cookie carrying arbitrary user information, administrative accounts included, and the gateway will accept it.

Certificate reuse

Exploitation needs a configuration that is common in practice: the same TLS certificate protects the HTTPS service (the public portal or gateway interface) and encrypts the authentication override cookie. In that setup the public key is available to anyone who completes a TLS handshake with the portal. With it, an attacker can build a valid cookie for any username, including the local administrator. The public certificate ends up working as a master key for forging VPN credentials. The Centre for Cybersecurity Belgium’s advisory describes the mechanism: “if the same certificate is used for both HTTPS services and authentication override cookies, attackers can obtain the public key from the HTTPS service and use it to generate forged cookies that the device will trust”.

Affected versions

Palo Alto Networks disclosed the vulnerability on May 13, 2026 with a CVSS 4.0 score of 7.8 (High). The National Vulnerability Database later assigned a CVSS 3.1 score of 9.1 (Critical). The affected products span several PAN-OS branches and Prisma Access:

Panorama and Cloud NGFW deployments are not affected. Hybrid Prisma Access environments still need the on-premises firewalls that run GlobalProtect portals or gateways upgraded, because a partial upgrade can cause cookie compatibility issues between components.

Exploitation in the wild

Rapid7’s observations

Rapid7’s Managed Detection and Response (MDR) team first saw exploitation attempts on May 17, 2026, four days after Palo Alto Networks published its advisory. The first wave came from infrastructure hosted by Vultr, and the attackers went after local administrator accounts with forged cookies. In eight of the ten targeted MDR customer environments the device accepted the authentication probes, though not every probe produced a full VPN session.

A second wave started on May 21, 2026, this time from Dromatics Systems. These attackers did get VPN IP assignments, which put them directly on internal corporate networks. Both waves used the same spoofed MAC address (aa:bb:cc:dd:ee:ff), so Rapid7 assessed that a single actor was behind both.

Arctic Wolf’s investigation of Qilin intrusions

Arctic Wolf Labs investigated multiple intrusions through June 2026. All began with CVE-2026-0257 exploitation and ended in Qilin ransomware deployment. The attack chain was mature and ran in four stages.

VPN access

The attackers used the authentication bypass to establish SSL VPN sessions as legitimate users without valid credentials. In some intrusions the attacking infrastructure identified itself with hostnames such as “kali,” which gives investigators a lead but is not proof of compromise on its own.

Credential harvesting and lateral movement

Once inside, the attackers moved quickly to credential-driven operations. Arctic Wolf documented consistent use of LSASS dumping to pull plaintext credentials and NTLM hashes from Windows memory, NTDS extraction to obtain the Active Directory database and with it every domain credential, Impacket and NTLM relay techniques for lateral movement, and PsExec over administrative shares for remote execution and payload delivery.

ReliaQuest also reported BloodHound and SharpHound, which means the attackers were mapping Active Directory attack paths and looking for the shortest route to domain admin.

Persistence and defense evasion

Post-exploitation tradecraft varied between victims, but Arctic Wolf saw a consistent pattern. The attackers staged ransomware payloads in C:\PerfLogs\, a directory that gets little monitoring. They disabled Microsoft Defender Real-Time Protection before encrypting, cleared Windows Event Logs with PowerShell one-liners, and set registry persistence using an asterisk followed by six random lowercase letters.

The log-clearing routine enumerated every available event log and called the ClearLog method on each:

$logs = Get-WinEvent -ListLog * | Where-Object {$_.RecordCount} | 
  Select-Object -ExpandProperty LogName
ForEach ($l in $logs | Sort | Get-Unique) {
  [System.Diagnostics.Eventing.Reader.EventLogSession]::GlobalSession.ClearLog($l)
}

Exfiltration and ransomware deployment

The final stage differed from intrusion to intrusion, which fits a RaaS model where several affiliates work under one brand. Some intrusions were encryption-only with minimal dwell time and no data theft. Others were full double-extortion campaigns with extensive reconnaissance, credential harvesting at scale, and exfiltration to MEGA, Proton Drive, and FileZilla before the ransomware ran, with Rclone handling the transfers. The operators also installed AnyDesk, Ngrok, and LogMeIn, which gave them backup access if one channel was cut.

Settra

ReliaQuest’s October 2026 update names Settra alongside Qilin as an active exploiter of CVE-2026-0257. Settra was first seen in June 2026 and has hit organizations in consumer services, retail, and manufacturing.

Huntress’s analysis of Settra incidents shows a different playbook. For initial access, Settra typically uses compromised VPN credentials and unpatched software. Once inside, it installs Bring Your Own Vulnerable Driver (BYOVD) payloads to disable security software at the kernel level and deploys the MeshAgent RMM tool for persistent remote access. Ransomware operators keep folding legitimate remote management tools into their intrusions, and that makes detection harder for any team that relies on spotting malicious binaries.

Why detection is hard

The attackers connect through the organization’s own VPN, so their traffic looks like ordinary remote worker activity at the network level. Firewalls, IDS/IPS, and VPN logs all record a successful, authenticated connection from an authorized user. A successful VPN login therefore cannot count as proof of legitimate access. Defenders have to look at what happens after authentication and correlate VPN session data with endpoint telemetry, identity analytics, and network traffic.

VPN log analysis

GlobalProtect authentication logs offer the most direct detection opportunity. Hunt for:

• Successful VPN sessions where the user field is null, empty, or a hyphen
• Authentication events for privileged accounts (administrator, admin) from unexpected source IPs or regions
• VPN connections from hosting provider ranges such as Vultr and Dromatics Systems
• Device hostnames that break the organization’s naming conventions (for example “kali,” “GP-CLIENT,” “DESKTOP-GP01”)
• Sessions where the source MAC address is spoofed or does not match the endpoint’s expected hardware address

A Sigma rule written for this threat flags possible authentication bypass by looking for successful VPN sessions with a null or empty user field.

EDR telemetry

Endpoint telemetry shows the post-exploitation activity. Key indicators:

• LSASS access by unusual processes or at unusual times, which points to credential dumping
• SharpHound.exe or BloodHound collectors running from temporary directories
• PsExec service installation and execution across many systems in quick succession
• File creation in C:\PerfLogs\, where legitimate use is rare
• Windows Defender real-time protection being disabled through PowerShell or Group Policy changes
• Event log clearing through wevtutil or PowerShell’s ClearLog method
• Rclone, AnyDesk, Ngrok, or LogMeIn running where those tools are not sanctioned

Network traffic analysis

The VPN traffic looks legitimate, but what happens downstream can give the intruder away:

• SMB traffic to administrative shares (ADMIN$, C$) from VPN-assigned IP addresses, especially across multiple systems in sequence
• LDAP query volumes from a single VPN client that match SharpHound reconnaissance
• Data transfers from VPN-connected endpoints to cloud storage services such as MEGA and Proton Drive
• Internal port scanning or service enumeration from VPN clients

Indicators of compromise

Palo Alto Networks’ Unit 42 has published indicators of compromise tied to CVE-2026-0257 exploitation.

Malicious IP addresses:

• 23.128.228[.]6
• 104.207.144[.]154
• 146.19.216[.]119
• 146.19.216[.]120
• 146.19.216[.]125
• 179.43.172[.]213
• 185.195.232[.]139
• 198.12.106[.]60
• 202.144.192[.]47

Suspicious host identifiers:

• MAC address: 00:11:22:33:44:55
• Hostnames: WINDOWS-LAPTOP-001, DESKTOP-GP01, GP-CLIENT

Feed these into SIEM correlation rules, firewall blocklists, and hunting queries. Attackers change IPs and hostnames easily, so not finding these indicators does not mean you were not compromised.

Mitigation and remediation

Patching

Upgrading to a fixed PAN-OS or Prisma Access version from Palo Alto Networks’ advisory is the only complete fix. Patching does not clean up sessions that were already established, though. ReliaQuest puts it this way: “patching alone may not remove access established before remediation, making session cleanup and follow-up investigation essential”. Terminate all active GlobalProtect sessions after you patch. The patched software changes cookie generation, so every user has to re-authenticate. That is expected behavior, and I would warn users beforehand.

Interim mitigations

If you cannot patch immediately, change the configuration to reduce exposure.

Separate the certificates. Generate a dedicated certificate used only for authentication override cookies. Store it securely with limited access, and never share it with the HTTPS portal or gateway service or derive it from any publicly exposed certificate. This breaks the attack chain, because the public key visible in the HTTPS handshake can no longer forge valid cookies.

Disable authentication override if you do not need it:

• Portal: Network > GlobalProtect > Portals > [Portal Name] > Agent > [Profile] > Authentication tab. Uncheck “Generate cookie for authentication override” and “Accept cookie for authentication override”.
• Gateway: Network > GlobalProtect > Gateways > [Gateway Name] > Agent > [Client Settings] > Authentication Override tab. Uncheck “Accept cookie for authentication override”.

Restrict network access to the GlobalProtect portal and gateway by IP, limiting connections to known corporate ranges. You can also add authentication layers that forged cookies cannot bypass: client certificate authentication independent of the cookie mechanism, multi-factor authentication, or conditional access policies based on device compliance and user risk.

Incident response

If you find evidence of exploitation, run a full incident response:

1. Rotate domain administrator, service account, and KRBTGT credentials immediately. The KRBTGT rotation matters most, since a compromised KRBTGT account enables Golden Ticket attacks.
2. Terminate all active GlobalProtect VPN sessions to cut off the attacker.
3. Review VPN logs, EDR telemetry, and network traffic from the initial exploitation date (mid-May 2026 for early campaigns) onward to scope the compromise.
4. Review outbound transfers to cloud storage services and assess what data left.
5. Hunt for and remove persistence, including scheduled tasks, registry modifications, and RMM tool installations.

VPNs as the preferred way in

CVE-2026-0257 fits a trend that has run through 2026: ransomware operators target VPN appliances for initial access. Industry data puts remote access services behind roughly 87 percent of ransomware claims in 2025, with VPN compromise accounting for about 73 percent of intrusions where the entry vector could be identified.

The appeal to attackers is easy to see. VPN gateways face the internet by necessity, give network-layer access to internal resources, receive less scrutiny than external connections, and are often managed separately from endpoint security, which leaves visibility gaps.

Qilin has gone after WatchGuard, Fortinet, and Check Point devices as well as Palo Alto Networks infrastructure. That pattern suggests VPN exploitation is now routine in the RaaS ecosystem, with initial access brokers finding VPN flaws and selling access to ransomware affiliates. An organization that deploys a VPN to enforce a security boundary is also creating a single point of failure, and compromising it undermines every control behind it.

Defensive recommendations

Within 24 hours

1. Inventory every GlobalProtect portal and gateway running affected PAN-OS or Prisma Access versions, and patch the internet-facing ones first.
2. Check whether authentication override cookies are enabled and whether the cookie encryption certificate is shared with the HTTPS service. Document the answer either way.
3. Review VPN logs back to May 17, 2026, focusing on privileged account access from unexpected sources.
4. After patching, terminate all active GlobalProtect sessions and force re-authentication.

Within one week

1. If authentication override cookies must stay on, generate a dedicated certificate used only for that purpose.
2. Deploy Sigma rules, SIEM correlation queries, and EDR detections for the techniques described above.
3. Hunt for post-exploitation indicators: LSASS access, SharpHound execution, PsExec usage, and exfiltration to cloud storage.
4. Decide whether authentication override cookies are operationally necessary, and disable them where they are not.

Longer term

1. Move toward zero-trust network access, which keeps validating user identity and device posture instead of granting broad network access after one authentication event.
2. Deploy network detection and response (NDR) for east-west visibility, so lateral movement and credential harvesting inside VPN-connected networks show up.
3. Set vulnerability management SLAs for internet-facing infrastructure, with critical vulnerabilities fixed within 24 to 48 hours of a patch becoming available.
4. Audit VPN and remote access configurations on a regular schedule for misconfigurations, certificate reuse, and features that are enabled without a need.

Conclusion

CVE-2026-0257 breaks the assumption that an authenticated VPN session can be trusted, and ransomware operators are already building intrusions on that break. For anyone running GlobalProtect, the order of work is patch, audit, then investigate back to mid-May. Check your own security infrastructure with the same suspicion you would apply to an outside threat. A VPN login should not be treated as proof of identity until the identity, device posture, and behavior behind it have been checked.