Ransomware operators are exploiting an authentication bypass in Palo Alto Networks’ remote-access products to enter corporate environments through connections that can resemble ordinary employee VPN traffic. The flaw, tracked as CVE-2026-0257, affects certain configurations of PAN-OS GlobalProtect and Prisma Access and has reportedly been used by groups including Qilin and Settra.

The activity raises the stakes beyond a conventional perimeter vulnerability. Once an unauthorized session is established through an organization’s own VPN infrastructure, subsequent traffic inherits a degree of trust. Attackers can use that position to seek credentials, map the environment, move laterally, collect data, and prepare encryption while blending into a familiar remote-access channel.

Why the GlobalProtect flaw is dangerous

CVE-2026-0257 is rated High with a CVSS score of 7.8. It can allow an unauthenticated attacker to bypass security controls and create a VPN connection, but exposure depends on how the service is configured. The vulnerable condition involves authentication override cookies together with a particular certificate setup. Consequently, administrators need to inspect their actual deployments rather than assume every appliance—or no appliance—is affected.

The affected product families include several maintenance releases across PAN-OS 12.1, 11.2, 11.1, and 10.2, as well as Prisma Access 11.2 and 10.2. Panorama and Cloud NGFW are not listed as affected. Because fixed status varies by maintenance release, teams should compare every portal and gateway with Palo Alto Networks’ version table.

Authentication override cookies are intended to simplify authentication between GlobalProtect components. The weakness arose because cookies could be trusted without sufficient validation and integrity protection under the relevant configuration. An attacker able to exploit that behavior could obtain access without presenting legitimate user credentials.

Ransomware activity follows initial VPN access

ReliaQuest observed the flaw in activity associated with Qilin and Settra and reported related use of offensive tools including Cobalt Strike, BloodHound, and SharpHound. Those tools can support command and control, Active Directory discovery, and attack-path mapping. Their presence shows why a successful VPN connection should be treated as the beginning of an investigation, not the end of an authentication check.

Earlier reporting linked Qilin intrusions using the same flaw to credential theft and eventual ransomware deployment. Evidence of use by another operation suggests the technique is spreading beyond one crew, potentially through initial-access brokers or shared playbooks. ReliaQuest expects exploitation to remain attractive over the coming months as attackers search for exposed, unpatched gateways.

Patch every component and remove old access

Organizations should apply the vendor’s fixed releases across all internal and external portals and gateways that issue or accept the affected cookies. Hybrid Prisma Access environments may also require updates to on-premises firewalls. A partial upgrade can cause cookie compatibility problems, so remediation should be planned as an environment-wide change.

• Disable authentication override cookies wherever the feature is not required.
• Create a dedicated new certificate for cookie signing and do not reuse portal, gateway, or other service certificates.
• Terminate active GlobalProtect sessions after patching so pre-remediation access cannot simply continue.
• Review unexpected devices, source addresses, login times, and unusual hostnames, then correlate them with endpoint and identity telemetry.

Users will need to authenticate again after the updated components begin generating new cookies. That inconvenience is important: installing a patch does not automatically evict an intruder who established a session earlier.

Detection must extend beyond the gateway

Security teams should hunt for activity after suspicious VPN logins, including credential dumping, directory enumeration, remote service use, new administrative accounts, unusual data staging, and connections to systems the user does not normally access. A device name such as “kali” can be a useful lead, but it is not proof by itself and should be evaluated with other evidence.

The broader lesson is that trusted access infrastructure becomes an effective disguise when attackers bypass its identity controls. Rapid patching closes the entry point; session invalidation and retrospective investigation determine whether the organization has actually removed the threat.