What's happening
Ransomware groups are actively exploiting CVE-2026-0257, an authentication bypass in Palo Alto Networks' PAN-OS GlobalProtect and Prisma Access. Per ReliaQuest's update released on October 11, 2026, multiple actors, including Qilin and Settra, are using it to open unauthorized VPN sessions into internal networks.
The flaw isn't new: disclosed on May 13, 2026, CVSS 7.8 (high), with the vendor's highest response urgency. What's changed is that exploitation is now broad and by more than one group, not just Qilin, seen earlier.
How it works
- The issue lies in GlobalProtect's authentication override cookies, used to re-authenticate across portal and gateway. The flaw involves relying on those cookies without proper validation and integrity checks.
- Only portals or gateways with the cookies enabled plus a specific certificate configuration are exposed. Not every deployment is vulnerable.
- Affected: PAN-OS 12.1, 11.2, 11.1 and 10.2; Prisma Access 11.2 and 10.2. Panorama and Cloud NGFW are not affected.
Why it's dangerous
Attackers come in through the company's own VPN. Traffic looks like normal remote work, giving time to steal credentials, move laterally and stage ransomware. ReliaQuest saw related Cobalt Strike, BloodHound and SharpHound activity, typical Active Directory recon before encryption.
ReliaQuest assesses it's highly likely exploitation continues over the next three months by ransomware groups and initial access brokers.
What to do
- Upgrade all GlobalProtect portals and gateways, internal and external, checking the advisory's exact fixed-version table, not just the major version. In hybrid Prisma Access, upgrade on-prem firewalls too.
- Disable override cookies where not needed.
- Use a new, dedicated certificate for the cookies; don't reuse the portal/gateway certificate or one from another service.
- Terminate all active GlobalProtect sessions after patching: patching doesn't remove established access. Users must re-authenticate.
- Investigate unexpected connections, such as devices with hostname "kali" (a lead, not proof), and signs of Cobalt Strike or SharpHound collection.
- Incomplete upgrades can cause cookie incompatibility between components; plan the window.
The lesson
VPNs are ransomware's favorite door in 2026: Check Point in June, Citrix NetScaler in September, now GlobalProtect. A successful VPN connection doesn't prove the user is legitimate; monitor what happens after it.
Sources
- Cybersecurity News (2026-10-11): https://cybersecuritynews.com/palo-alto-globalprotect-flaw-vpn-access/
- Hackers Radar (2026-10-11): https://hackersradar.com/critical-palo-alto-globalprotect-cve-2024-3400-exploited-by-ransomware/
- Palo Alto Networks security advisories: https://security.paloaltonetworks.com/
Want to review your VPN and detection of suspicious access? KGA IT offers a free consultation: kga-it.com.