GlobalProtect CVE-2026-0257 and Ransomware

13 May: an advisory that names a feature and a certificate

DOCUMENTED. On 13 May 2026, Palo Alto Networks published an advisory describing authentication bypass flaws in the GlobalProtect portal and gateway of PAN-OS that let an attacker establish an unauthorized VPN connection. The page lists CWE-565, reliance on cookies without validation and integrity checking, as the weakness. PAN-OS 10.2, 11.1, 11.2 and 12.1 and two Prisma Access releases sit in the affected table, while Cloud NGFW and Panorama are listed as not impacted.⁠¹

A firewall is exposed when a GlobalProtect portal or gateway is configured, authentication override cookies are enabled, and a certificate condition holds. The advisory gives the menu paths for checking the cookie setting and spells out the certificate condition only in its mitigations: use a dedicated certificate for override cookies, and do not reuse the portal or gateway certificate.⁠¹ Rapid7, which examined the service on a test appliance, REPORTS that the feature is off by default and that exposure arises where the cookie certificate is shared with another feature such as the HTTPS service.⁠⁵

DOCUMENTED: the advisory's required-configuration section refers to a certificate condition without saying what it is.

17–29 May: first exploitation, a public test script and a KEV entry

Rapid7's managed detection team DOCUMENTS that the earliest exploitation it saw was on 17 May 2026, four days after the advisory. It found cookie authentication to the local admin account across several customer environments from one hosting provider, then a second wave on 21 May from a different provider, with internal VPN addresses assigned.⁠⁵ Measured In 8 of 10 affected Rapid7 customers the appliance accepted a forged cookie without a full VPN session being established, and Rapid7 saw no sign of lateral movement.⁠⁵ The entry point was an internet-facing VPN gateway, the same product class as the Citrix and Ivanti edge zero-days we covered earlier.⁠⁵

Three things are dated 29 May. CISA added the CVE to its Known Exploited Vulnerabilities catalog on evidence of active exploitation.⁠⁶ Palo Alto Networks updated the advisory's exploitation status.⁠¹ Rapid7 published its analysis and linked a public script, written by its Labs team, that tests whether an appliance accepts a forged cookie.⁠⁵ Rapid7 also states that the vendor raised the CVSS 4.0 score from 4.7 to 7.8 that day, a change the advisory's change log does not list.⁠⁵⁠¹

DOCUMENTED, and in conflict: Unit 42's brief puts the KEV listing on 13 May, while CISA's bulletin is stamped 29 May.⁠³⁠⁶

June: Arctic Wolf follows intrusions to Qilin encryption

Unit 42's brief of 5 June DOCUMENTS exploitation by an unidentified actor attempting to reach GlobalProtect. It found no post-access behavior or lateral movement, and only a small portion of the probed devices established VPN sessions.⁠³

On 20 July, Arctic Wolf Labs reported multiple distinct intrusions in June 2026 that began with CVE-2026-0257 and ended in Qilin ransomware, with the CVE named as the confirmed or assessed initial access vector in each.⁠² In some, the VPN sessions came from systems identifying themselves as kali hosts, and several IP addresses appeared both as exploitation sources and as session origins. Inside, the actors dumped credentials from LSASS memory, extracted the domain database, moved with PsExec over administrative shares, staged the payload in C:\PerfLogs\ and cleared event logs before encryption.⁠² Our piece on exploitation as a leading breach entry point covers how often this route is the way in across breaches.

REPORTED, as Arctic Wolf's own assessment: the differences between intrusions, from encryption-only to data theft first, may point to several affiliates working under Qilin's ransomware-as-a-service model. Some intrusions sent data to MEGA with rclone; others showed no exfiltration. Arctic Wolf says the overlapping infrastructure fits either one actor holding the exploit or shared tooling, and it assesses with moderate confidence that such intrusions are likely ongoing.⁠²

9–20 October: Qilin, Inc and Settra

On 9 October, ReliaQuest said in a social media post that multiple groups, including the Qilin and Settra operations, were exploiting the flaw to open unauthorized VPN sessions; Infosecurity Magazine reported it on 12 October. REPORTED: ReliaQuest saw Cobalt Strike, BloodHound and SharpHound in related activity, rated continued exploitation highly likely over the next three months, and warned that "patching alone may not remove access established before remediation."⁠⁴

Reported Unit 42's update of 19 October says it observed attempted exploitation by ransomware operators including Spikey Scorpius (Qilin) and Tarnished Scorpius (Inc), and it cites public reporting for Settra without attributing that group itself.⁠³ The brief says attackers use the flaw as an initial foothold, bypass multi-factor authentication to open a VPN session, then run reconnaissance with remote monitoring tools, move over RDP and SMB, and stage credential theft, exfiltration and encryption. Its investigations have run since early June across eleven sectors, by GetCoreTech's count of its list, among them healthcare, manufacturing, financial services and government.⁠³

CLAIMED, by Unit 42: the largest change after access is a pivot to the virtualization layer. In one case attackers moved from the gateway to the vCenter appliance, disabled the ESXi execInstalledOnly control and used a custom tool to dump credentials offline from a domain controller's virtual disk, a route Unit 42 says bypasses in-guest EDR. It also saw access chained with exploit tools aimed at Veeam backup software, CVE-2023-27532.⁠³

What Palo Alto Networks says, and what its pages show

DOCUMENTED. The advisory's exploitation-status section is one sentence about attempts on unpatched devices without mitigations, its exploit-maturity field reads ATTACKED, and its urgency reads HIGHEST. It does not mention ransomware.⁠¹ Unit 42's brief, published by the same company, repeats the "limited" sentence at the top of its 19 October update and, in the same update, says ransomware operators are exploiting the flaw.⁠³

Severity differs by publisher. Palo Alto Networks rates the flaw 7.8 under CVSS 4.0, and the advisory says that score moves with exploitation evidence.⁠¹ The National Vulnerability Database enrichment team gave it 9.1 under CVSS 3.1, according to Infosecurity Magazine.⁠⁴ The brief also lists Palo Alto Networks products and incident-response contacts, so the vendor is both the maker of the affected product and a seller of response services.⁠³

Fixes: builds, release dates and the one-time re-login

DOCUMENTED. The advisory lists 12.1.7 or 12.1.4-h6, 11.2.12 or a hotfix such as 11.2.10-h7, 11.1.15 or a hotfix such as 11.1.13-h5, and 10.2.18-h6 or a hotfix such as 10.2.16-h7 as fixed PAN-OS builds. For Prisma Access it lists 11.2.7-h13 and 10.2.10-h36, which the vendor says it is upgrading for all customers on a schedule shared with them. Older unsupported PAN-OS versions get no fix, only an instruction to move to a supported one.⁠¹

The change log records fix-release-timeline updates on 14 May (10.2.16-h7), 15 May (12.1.4-h6, 11.2.7-h14, 11.2.10-h7), 16 May (10.2.13-h21), 20 May (10.2.7-h34) and 28 May (11.1.15, 11.1.7-h6, 11.2.4-h17, 11.2.12, 12.1.7).⁠¹ Rapid7's first observed exploitation, on 17 May, therefore preceded the 28 May entries. The log does not say whether each entry marks a release or a scheduled date.⁠⁵

Upgrades carry conditions. Every portal and gateway that generates or accepts override cookies, internal ones included, should be upgraded together to avoid cookie compatibility failures, and hybrid Prisma Access deployments need their on-premises firewalls upgraded too. Users re-authenticate once after an upgrade because the firewall regenerates cookies by a stronger method. For phased upgrades the advisory documents a setting that temporarily relaxes strict cookie HMAC validation on upgraded firewalls, to be switched back on once every component is fixed. The workarounds are a dedicated override-cookie certificate or turning authentication override off.⁠¹

DOCUMENTED: a certificate that once served another feature cannot be reused for override cookies, even after it is removed from that feature.⁠¹

No victim count, no access-broker record, no Settra confirmation

The documents leave these points open.

• Settra attribution. REPORTED by ReliaQuest through one news account. Unit 42 repeats it as public reporting and does not confirm it, and the original post was not reachable for this article. Until a second observer names Settra, it is a single-source claim.⁠⁴⁠³
• Victim counts. Arctic Wolf reports "multiple distinct intrusions" and Unit 42 reports investigations across eleven sectors, but neither gives a number of organizations hit by ransomware through this flaw. Without one, the share of exposed devices that ended in encryption cannot be estimated.⁠²⁠³
• How access reached affiliates. Arctic Wolf says the overlapping infrastructure fits one actor with the exploit or shared tooling. It does not say whether Qilin affiliates built, bought or were handed the access, and no document states an arrangement.⁠²
• Fix release dates. The change log gives timeline updates, not release dates, so the gap between first exploitation on 17 May and fixes for five builds listed on 28 May, including 11.1.15 and 12.1.7, cannot be measured from the page.⁠¹⁠⁵
• The KEV date. Unit 42's brief carries updates through 26 October without correcting its 13 May date, and the advisory sends readers to that brief for indicators.⁠³⁠¹

What to check, and the date to watch

The sources point to five checks, in this order. DOCUMENTED: the advisory's severity rating rose with exploitation evidence while its base score stayed unchanged, the gap that prioritizing actively exploited vulnerabilities is meant to close.⁠¹

1. Open the portal's agent configuration (Authentication tab) and each gateway's Authentication Override tab, the paths the advisory gives. If cookie generation or acceptance is checked, confirm the cookie certificate is dedicated and not shared with the HTTPS service.⁠¹
2. After upgrading every portal and gateway, terminate all active GlobalProtect sessions, which Arctic Wolf and ReliaQuest both advise.⁠²⁠⁴
3. Search GlobalProtect authentication logs from at least 17 May 2026, the earliest exploitation Rapid7 saw, for cookie logins to the admin account from hosting-provider addresses, for the hostnames kali, GP-CLIENT, DESKTOP-GP01 and WINDOWS-LAPTOP-001, and for the MAC address aa:bb:cc:dd:ee:ff that Rapid7 and Unit 42 list.⁠⁵⁠³⁠²
4. For any hit, Arctic Wolf advises assuming domain compromise and rotating credentials, KRBTGT twice included, then looking for LSASS dumping, NTDS extraction, PsExec on administrative shares, executables in C:\PerfLogs\, AnyDesk, Ngrok or LogMeIn installs, rclone traffic to MEGA, and Windows event ID 1102 log clearing.⁠²
5. Unit 42 says it found management interfaces exposed on ports 4443 and 3879 when GlobalProtect profiles were mapped to management services, so test both ports from outside, and review vCenter, ESXi and Veeam hosts after a confirmed hit.⁠³

REPORTED. Unit 42's brief last logged an update on 26 October 2026 and says it will add information as it becomes available.⁠³ ReliaQuest's 9 October alert rated continued exploitation highly likely for three months, which runs to about 9 January 2027 by GetCoreTech's arithmetic.⁠⁴