CVE-2026-0257, a GlobalProtect authentication bypass that Palo Alto Networks patched in May 2026, is now being used by ransomware crews. Unit 42 updated its threat brief on 20 October 2026 to add verification steps, and Qilin, INC and Settra operators have all been linked to the flaw. It scores 7.8, rated high.
What CVE-2026-0257 Actually Does
The flaw lets an attacker who has never authenticated open a VPN connection into a network. It sits in the GlobalProtect portal and gateway components of PAN-OS, the operating system on Palo Alto Networks firewalls, and it works by abusing the Authentication Override cookies those components use to avoid re-prompting a user.
Palo Alto Networks, the Santa Clara firewall maker, rates it 7.8 on the CVSS 4.0 scale, severity high. The practical effect is that multi-factor authentication does not stop it: Unit 42, the company’s own threat intelligence team, records attackers bypassing MFA outright to establish a session.
Why a May Vulnerability Is October News
Nothing about the vulnerability changed this month. What changed is who is using it and what they do afterwards.
- 13 May 2026: Palo Alto Networks publishes the advisory, and CISA, the United States Cybersecurity and Infrastructure Security Agency, adds the flaw to its Known Exploited Vulnerabilities catalog the same day.
- 29 May 2026: A public proof-of-concept exploit is released, putting a working attack in general circulation.
- Early June 2026: Unit 42 begins investigating incidents tied to the flaw. Arctic Wolf separately investigates several Qilin-linked attacks that month.
- 3 June 2026: Palo Alto Networks last revises the advisory.
- 9 October 2026: ReliaQuest reports activity involving Settra ransomware.
- 20 October 2026: Unit 42 updates its threat brief at 1:30 p.m. Pacific time to add exposure verification and remediation guidance.
Palo Alto Networks’ own wording in the advisory remains measured: the company says it “has become aware of limited exploit attempts on unpatched PAN-OS devices without mitigations applied”. Brandon Tirado, a vice president in ReliaQuest’s GreyMatter Operations, told Cybersecurity Dive that the flaw has become a reliable way into networks for ransomware groups. Neither Palo Alto Networks nor the research firms have published a victim count.
Which PAN-OS Versions Need the Fix
Every supported PAN-OS branch is affected, and each has its own fixed build rather than one universal patch.
| Branch | Affected versions | Fixed in |
|---|---|---|
| PAN-OS 12.1 | 12.1.2 to 12.1.6 | 12.1.4-h6, or 12.1.7 and later |
| PAN-OS 11.2 | 11.2.0 to 11.2.11 | 11.2.4-h17, 11.2.7-h14, 11.2.10-h7, or 11.2.12 and later |
| PAN-OS 11.1 | 11.1.0 to 11.1.14 | 11.1.4-h33, 11.1.6-h32, 11.1.7-h6, 11.1.10-h25, 11.1.13-h5, or 11.1.15 and later |
| PAN-OS 10.2 | 10.2.0 to 10.2.18-h* | 10.2.7-h34, 10.2.10-h36, 10.2.13-h21, 10.2.16-h7, or 10.2.18-h6 and later |
| Prisma Access | 10.2.0 to 10.2.10-h*, 11.2.0 to 11.2.7-h* | 10.2.10-h36 and 11.2.7-h13 |
| Cloud NGFW | Not affected | No action needed |
Which build you need depends on the maintenance line you are already on, so the advisory’s upgrade table matters more than the highest number in the list. Unsupported PAN-OS releases have no fix and must move to a supported branch. Palo Alto Networks is upgrading Prisma Access tenants itself on a published schedule, but on-premises firewalls in a hybrid Prisma Access deployment still need manual upgrading.
Where upgrading immediately is not possible, Palo Alto Networks lists two mitigations: use a certificate dedicated solely to authentication override cookies rather than one shared with the portal or gateway, and disable the Authentication Override options for generating and accepting cookies on both.
What Happens After the VPN Session Opens
Unit 42’s investigations describe a consistent progression from VPN access to encrypted servers, and in at least one case it reached the virtualisation layer.
- Bypass MFA and establish a GlobalProtect VPN session.
- Run internal reconnaissance using dual-use remote monitoring and management tools, which are harder to flag than malware.
- Move laterally over RDP and SMB.
- Stage tooling for credential harvesting, data theft and ransomware deployment.
In one incident, Unit 42 reports, the attackers pivoted from the VPN gateway to the vCenter appliance, disabled security controls on ESXi hosts, and then dumped credentials offline from a domain controller’s virtual disk file. That last step matters because it sidesteps the protections that guard a running domain controller. Unit 42 also saw the flaw chained with an older Veeam backup vulnerability, CVE-2023-27532, which puts the backups and the live estate at risk together.
Two qualifications belong with that. Unit 42 says only a small portion of probed devices went on to establish a VPN session, and in its earliest reporting it had identified no post-access movement at all. The escalation is recent. Justin Moore, director of adversary operations at Arctic Wolf, told Cybersecurity Dive that access gained this way can be converted quickly into persistent remote access. Reported targets span education, financial services, healthcare, IT, manufacturing and government.
How to Check Whether You Are Exposed
Unit 42’s 20 October update centres on one question: is the management interface reachable from outside? These are the checks it specifies.
- From a browser outside your network, try an HTTPS connection to the firewall’s management IP address on ports 4443 and 3879. A response means the interface is exposed.
- Restrict management interface access with Interface Management profiles, allowing only the addresses that genuinely need it.
- Search GlobalProtect logs for the proof-of-concept’s hard-coded values: an endpoint operating system of “Microsoft Windows 10 Pro 64-bit” together with an empty source user domain.
- Hunt the IP addresses, host names and MAC addresses published in Unit 42’s indicator list, and open an incident response case for any that reached a gateway successfully.
- Apply the fixed build for your branch, or the two mitigations above if you cannot upgrade yet.
Treat a device that was internet-reachable on a vulnerable build as suspect rather than clean. That was the lesson of the NetScaler zero-days in September, where patching alone left compromises in place, and of the Ivanti Connect Secure bypass earlier this month.
CVE-2026-0257 FAQ
Is CVE-2026-0257 Patched?
Yes. Palo Alto Networks published fixes on 13 May 2026 and last revised the advisory on 3 June 2026. The current exploitation is against devices that have not applied them.
What Is the CVE-2026-0257 Severity Score?
7.8 on the CVSS 4.0 scale, rated high. It is not a maximum-severity flaw, but it requires no authentication and no user interaction.
Does Multi-Factor Authentication Protect Against It?
No. Unit 42 documents attackers bypassing MFA to establish a GlobalProtect VPN session, because the flaw abuses the authentication override mechanism rather than defeating a login.
Which Ransomware Groups Are Exploiting CVE-2026-0257?
Qilin, which Unit 42 tracks as Spikey Scorpius, and INC, tracked as Tarnished Scorpius. ReliaQuest reported Settra ransomware activity on 9 October 2026.
Is Prisma Access or Cloud NGFW Affected?
Prisma Access is affected and has fixed builds 10.2.10-h36 and 11.2.7-h13; Palo Alto Networks is upgrading tenants on its own schedule. Cloud NGFW is not affected and needs no action.
