Palo Alto GlobalProtect VPN Flaw Now Used by Ransomware Groups: What to Check

If your business uses a Palo Alto Networks firewall with GlobalProtect for remote access, this one needs attention. On October 19 and 20, 2026, Palo Alto Networks' Unit 42 research team updated its threat brief to say that ransomware groups are now trying to use a GlobalProtect flaw, tracked as CVE-2026-0257, to get into business networks.

The flaw was first disclosed and fixed in May 2026, and CISA added it to its list of vulnerabilities known to be exploited the same day. What is new is who is using it: Unit 42 names the groups it tracks as Spikey Scorpius (also known as Qilin) and Tarnished Scorpius (also known as Inc), and notes public reporting that links it to Settra ransomware as well.

The short version: if you run GlobalProtect, confirm your firewall is on a fixed PAN-OS version, or apply Palo Alto's workaround, and have someone review your VPN logs for connections you don't recognize.

What the flaw does

According to Palo Alto Networks' advisory, CVE-2026-0257 is an authentication bypass in the GlobalProtect portal and gateway. It can let an attacker set up a VPN connection without valid credentials. Unit 42 says attackers have used it to get past multifactor sign-in and land on the network like a remote employee would.

Who is at risk

• Palo Alto firewalls running PAN-OS 10.2, 11.1, 11.2 or 12.1 below the fixed versions listed in the advisory, plus some Prisma Access deployments.
• Only setups where GlobalProtect is configured with authentication override cookies turned on and a specific certificate configuration in place. Palo Alto's advisory explains how to check these settings.
• Panorama and Cloud NGFW are not affected.

What attackers do once inside

Unit 42 says that after connecting, attackers typically look around the network using ordinary remote management tools, move between computers using Windows remote desktop and file sharing, steal passwords and data, and then deploy ransomware. In one case they moved from the VPN to the company's VMware management system and copied passwords straight from a domain controller's virtual disk. Unit 42 has also seen the same intrusions use an older flaw in Veeam backup software (CVE-2023-27532). Its investigations cover many industries, including healthcare, manufacturing, professional and legal services, retail and education.

What to do this week

1. Update PAN-OS. Upgrade to a fixed version from Palo Alto's advisory. Palo Alto notes that all GlobalProtect portals and gateways that use authentication cookies should be upgraded together, and that users will need to sign in once again after the upgrade.
2. If you can't update right away, use the workaround. Palo Alto says you can either use a new certificate dedicated only to authentication override cookies, or turn the authentication override cookie options off in the GlobalProtect portal and gateway settings.
3. Check your VPN logs. Unit 42's brief lists IP addresses and device names to search for in GlobalProtect logs. Any successful connection that matches should be treated as a possible break-in.
4. Make sure the firewall's management page isn't on the internet. Unit 42 says it often found GlobalProtect setups that accidentally exposed the management interface, notably on ports 4443 and 3879.
5. Patch your backup server too. If you run Veeam Backup & Replication, confirm it is current, since attackers have paired this flaw with an older Veeam one.

Questions to ask your IT provider

1. Do we use GlobalProtect, and is our firewall on a fixed PAN-OS version for CVE-2026-0257?
2. Are authentication override cookies turned on, and if so, have we applied the workaround?
3. Has anyone checked our VPN logs against the indicators Palo Alto published?
4. Is our firewall's management interface reachable from the internet?

Sources

• Palo Alto Networks: CVE-2026-0257 PAN-OS GlobalProtect Authentication Bypass Vulnerabilities
• Unit 42: Active Exploitation of May 2026 PAN-OS CVE-2026-0257 (updated October 2026)
• CISA: Known Exploited Vulnerabilities Catalog