A serious vulnerability in Palo Alto Networks’ GlobalProtect VPN—tracked as CVE-2026-0257—is being actively exploited by ransomware operators to bypass multi-factor authentication, infiltrate networks, and steal credentials directly from virtual disks. In one instance, attackers moved past the virtual layer to extract domain controller credentials without ever triggering endpoint security tools. This ruthless tactic marks a new escalation in how threat actors are compromising corporate defenses.
How the Flaw Works
The vulnerability affects GlobalProtect portals and gateways running certain versions of PAN-OS, and some configurations of Prisma Access. It’s not in Panorama or Cloud NGFW. Attack exposure requires two specific configuration errors: authentication override cookies must be enabled, and the same certificate must be reused for both HTTPS and cookie encryption. When those conditions are met, attackers can harvest the public key exposed by the HTTPS service to forge authentication cookies. Once decrypted by the appliance, those cookies are trusted without verifying their origin, granting VPN access without credentials or MFA. Palo Alto rates the severity as “High” with a CVSS score of 7.8.
Real-World Exploitation: What Attackers Are Doing
Threat intelligence from Unit 42, Rapid7, and public reporting confirms that ransomware groups Spikey Scorpius (also known as Qilin) and Settra are among those exploiting this issue. Since at least mid-June, sectors including education, healthcare, government, energy, manufacturing, and finance have been targeted. Once inside via the VPN, attackers perform network reconnaissance using remote monitoring and management tools, then move laterally through RDP and SMB protocols.
In the most striking case, adversaries compromised a gateway, then reached VMware’s vCenter management appliance. They disabled the “execInstalledOnly” guard on ESXi hosts and leveraged a custom tool to read credentials directly from the domain controller’s VMDK virtual disk. This move bypassed detection by in-guest endpoint detection and response (EDR) systems. The attackers also chained in other vulnerabilities—such as CVE-2023-27532 affecting Veeam backup infrastructure—to amplify their access.
Defensive Measures & Mitigation Steps
To defend against CVE-2026-0257, Palo Alto’s advisory calls for immediate patching to fixed versions of PAN-OS across all GlobalProtect portals and gateways. For those unable to patch immediately, mitigations include disabling authentication override cookies or generating a certificate used solely for that feature. Sharing certificates with other services—especially the HTTPS portal—must be avoided.
Security teams are also urged to review GlobalProtect logs for gateway-connected events, especially from unusual IPs, client names like “GP-CLIENT” or “DESKTOP-GP01”, and unusual host IDs such as “aa:bb:cc:dd:ee:ff”. Even failed VPN connection attempts may indicate probing activity. Monitoring for logs where auth type equals “override_cookie” has been identified as a valuable indicator.
This is more than a VPN bypass—it’s a wake-up call. CVE-2026-0257 blurs the line between valid remote access and a full blow compromise. Organizations must rethink trust at the perimeter, eliminate certificate reuse, enforce strict cookie handling, and move toward zero-trust models. The attack shows how vulnerabilities left unpatched—even those announced months ago—can become weapons in someone else’s ransomware campaign. Watch for threats that leverage virtualization layers next; defense strategies must assume byzantine attackers are already inside.
