A Patched Flaw Still Being Used for Initial Access
Ransomware operators continue to exploit CVE-2026-0257, an authentication bypass vulnerability affecting GlobalProtect in certain PAN-OS and Prisma Access configurations. In its October 19, 2026 update, Unit 42 explicitly names Qilin, tracked as Spikey Scorpius, and INC, tracked as Tarnished Scorpius.
This alert is not about a new zero-day: patches have been available since May 2026. The news is the persistence of attacks and the documented consequences, including the targeting of virtualization and backup infrastructure. Exposed organizations have two priorities: patch the entry point and investigate evidence of an earlier compromise.
What CVE-2026-0257 Allows
According to Palo Alto Networks' advisory, the flaw affects GlobalProtect portal and gateway components. It can allow an unauthenticated attacker to establish an unauthorized VPN connection. The listed CVSS v4.0 score is 7.8, with the vendor assigning its highest remediation urgency.
Exposure depends on several conditions: a GlobalProtect portal or gateway must be configured, authentication override cookies must be enabled, and a specific certificate configuration must be present. Not every PAN-OS installation should therefore be treated as vulnerable.
These cookies normally allow an authentication to be reused. Flawed handling can cause a session to be accepted without enforcing the expected authentication checks, including MFA in the attacks described by Unit 42. This is not a general weakness in all MFA mechanisms, nor does this CVE directly provide code execution.
Panorama and Cloud NGFW are not affected, the vendor states. Prisma Access is included in the advisory's product scope, but the public observations reviewed do not break down victims between on-premises PAN-OS and Prisma Access. They also do not establish a service-wide compromise of the cloud platform.
Qilin, INC, and Settra: Distinguishing the Attributions
Unit 42 reports investigations dating back to early June 2026 across numerous sectors, including healthcare, education, financial services, manufacturing, energy, and government. Its October update describes Qilin and INC using this flaw to gain initial access to corporate networks.
For Settra, Unit 42 points to public reporting from ReliaQuest. The Hacker News' October 20 coverage preserves this distinction. Settra is therefore an attribution reported by a third party, not an observation that should be presented as Unit 42's own finding in this bulletin.
The report also retains historical passages stating that no lateral movement had been identified in the earliest observations. The section explicitly dated October 19 adds subsequent evidence of post-compromise activity. That update supports the current assessment, without implying that every attempt succeeded or followed the same attack chain.
From the VPN to Hypervisors and Backups
After a VPN session is established, Unit 42 describes internal reconnaissance, the misuse of remote administration tools, lateral movement over RDP and SMB, and the staging of tools for credential theft, exfiltration, and ransomware deployment.
One case illustrates a particularly significant risk: attackers moved to vCenter, then changed security controls on ESXi hypervisors. They subsequently used a custom tool to extract authentication information offline from a domain controller's virtual disk.
The defensive challenge extends beyond user endpoints. Operations performed on virtual disks from the virtualization layer can fall outside the visibility of an EDR agent installed inside the virtual machine. This does not mean that all EDR is ineffective; it means hypervisor management consoles must also be monitored and segmented.
Unit 42 also reports the use of tools targeting Veeam backup infrastructure, including CVE-2023-27532, after this initial access. That scenario is not universal, but it warrants checking the security of backups and their administrative accounts alongside VPN remediation.
Patch PAN-OS and Verify Prisma Access
The vendor advisory provides several fixes depending on the release branch and starting version. Listed fixed releases include PAN-OS 12.1.7, 11.2.12, and 11.1.15, as well as hotfixes for other versions, including 10.2.18-h6. These are not universal upgrade targets: follow the matrix and upgrade path applicable to each device.
For Prisma Access, the advisory lists 10.2.10-h36 and 11.2.7-h13 as fixed versions for the corresponding branches. Note that the hotfix listed for PAN-OS 11.2.7 is 11.2.7-h14, not the Prisma Access build. Prisma Access upgrade schedules are communicated to customers; the tenant's actual status should be confirmed with the vendor.
In a hybrid environment, upgrading the cloud service does not replace patching on-premises firewalls. Palo Alto Networks calls for coordination across internal and external portals and gateways that generate or accept these cookies to avoid compatibility issues. Users should expect to reauthenticate after the fix is applied.
If immediate patching is not possible, the vendor offers two mitigations:
- Disable Authentication Override by clearing the options that generate and accept cookies on the affected components.
- Generate a new certificate exclusively for these cookies, separate from the portal or gateway certificate and not shared with other features or users.
Removing an old certificate from other services is insufficient: the advisory requires a new, dedicated certificate. Validate these changes with network and identity teams to manage the impact on legitimate connections. Any temporary compatibility settings must not leave cookie protections disabled indefinitely.
What the SOC Should Look For
Unit 42 recommends searching for successful GlobalProtect gateway-connected events associated with the indicators in its bulletin, then initiating incident response when that correlation is established.
The report mentions hostnames such as WINDOWS-LAPTOP-001, DESKTOP-GP01, and GP-CLIENT, as well as identifiers such as aa:bb:cc:dd:ee:ff and 00:11:22:33:44:55. It also describes client values from the public PoC, including a generic Windows version and an empty user domain.
These values are not standalone proof of compromise. Correlate them with source IP addresses, accounts, timestamps, authentication logs, and internal traffic. The bulletin's IP list is specifically associated with activity preceding the May 29 PoC release: it is useful for historical hunting, but is not an exhaustive list of infrastructure used in October.
Incident response teams should prioritize the following actions:
- Preserve evidence: export VPN, identity, network, vCenter, ESXi, and backup logs before they are overwritten.
- Contain suspicious access: terminate identified sessions, restrict traffic to management consoles, and investigate the accounts involved.
- Hunt for lateral movement: correlate VPN sessions with RDP and SMB connections, newly introduced administration tools, and hypervisor configuration changes.
- Address exposed credentials: revoke or rotate affected access according to the incident's scope, after securing systems that could allow the credentials to be captured again.
- Protect recovery: verify backup integrity and isolation, review the accounts that administer backups, and test restoration from a clean environment.
These steps are defensive recommendations; they do not presume that an organization has been compromised simply because it uses GlobalProtect.
Key Takeaways
CVE-2026-0257 demonstrates how an authentication weakness at the network edge can open the door to a much broader ransomware incident. Having MFA does not remove the need to patch the component that decides whether to accept a session. And a gateway that is now patched does not guarantee that secondary access was not established earlier.
The priority is to verify the configuration, apply the appropriate fix, and then investigate historical access and management systems reachable from the VPN.
Sources
- Palo Alto Networks: CVE-2026-0257 Security Advisory, affected configurations, fixed versions, and mitigations; accessed October 20, 2026.
- Unit 42: Active Exploitation of PAN-OS CVE-2026-0257, October 19, 2026 update on ransomware activity.
- The Hacker News: Qilin and INC Ransomware Groups Exploit Palo Alto Networks Flaw to Bypass MFA, October 20, 2026.
Written on October 20, 2026. Attributions are those of the cited sources. Consult the latest vendor advisory before taking action.