Tuesday 10 November 2026 950 stories on file Full archive
Daily Edition
newscms

Volume III Edition Daily

Ransomware Groups Walk Through the Front Door: The GlobalProtect Flaw That Forges VPN Logins

A critical authentication bypass in Palo Alto Networks GlobalProtect VPN appliances is being actively exploited by ransomware groups to establish unauthorized network access, turning trusted remote access services into…

Cybersecurity 1,193 words 6 min read By cms-publishing

Ransomware Groups Walk Through the Front Door: The GlobalProtect Flaw That Forges VPN Logins — Cybersecurity No Image Cybersecurity
Lead image · Filed 12 October 2026, 04:54

Ransomware Groups Walk Through the Front Door: The GlobalProtect Flaw That Forges VPN Logins

Introduction

A critical authentication bypass in Palo Alto Networks GlobalProtect VPN appliances is being actively exploited by ransomware groups to establish unauthorized network access, turning trusted remote access services into open doorways. The vulnerability, tracked as CVE-2026-0257, has already been weaponized by both Qilin and Settra ransomware operators, according to security monitoring firm ReliaQuest, marking one of the most concerning attack chains of 2026.

The danger lies in the stealth of the attack. Once threat actors exploit the flaw, they appear as legitimate remote workers, bypassing the need for credentials or multi-factor authentication. This gives them a foothold that looks completely normal to security monitoring systems until the damage is already underway.

A Cookie That Opens the Door

CVE-2026-0257 is a configuration-dependent authentication bypass rated HIGH severity with a CVSS score of 7.8. The flaw affects the GlobalProtect portal and gateway components of PAN-OS software, allowing an unauthenticated attacker to bypass authentication entirely.

The attack succeeds when three conditions align. First, organizations must have authentication override cookies enabled in their GlobalProtect settings. Second, a specific certificate configuration must be in place. Third, the certificate used for authentication override is either reused elsewhere or has been exposed publicly. Under these circumstances, a threat actor can forge valid authentication cookies using the exposed certificate, effectively creating fully authenticated VPN sessions without ever knowing valid credentials.

Palo Alto Networks disclosed the vulnerability on May 13, 2026. Within days, the flaw was already seeing active exploitation in the wild. Rapid7 published a working proof-of-concept exploit on May 29, and the same day CISA added CVE-2026-0257 to its Known Exploited Vulnerabilities catalog, triggering mandatory remediation deadlines for federal agencies.

From Disclosure to Ransomware in Six Months

The exploitation timeline reveals a textbook example of how new vulnerabilities transition from theoretical risk to real-world damage. Active exploitation was first observed as early as May 17, just four days after the initial disclosure. Arctic Wolf reported a surge in activity beginning in early June, and by July 20, researchers documented multiple incidents where the GlobalProtect flaw provided initial access before transitioning into full credential theft and Qilin ransomware deployment.

The attack chain observed in these incidents follows a predictable pattern. Threat actors use the forged VPN credentials to gain initial access, then leverage tools like Impacket for lateral movement, conduct NTLM relay attacks, and deploy post-exploitation frameworks such as Cobalt Strike along with BloodHound and SharpHound for privilege escalation mapping. ReliaQuest's October 11 update confirmed that Settra is now also leveraging this vulnerability, broadening the risk beyond a single ransomware group.

In observed Qilin deployments, attackers have reached into Active Directory to steal LSASS and NTDS data, installed remote access tools like AnyDesk and Ngrok, and staged data exfiltration to cloud storage before encrypting systems. The "kali" hostname has emerged as a strong malicious indicator, appearing across multiple campaigns as attackers leverage familiar penetration testing tooling for their operations.

Affected PAN-OS versions include 12.1.x, 11.2.x, 11.1.x, and 10.2.x, as well as Prisma Access deployments using authentication override cookies. Notably, Panorama and Cloud NGFW deployments remain unaffected by this specific bypass.

Why Attackers Love the VPN Front Door

The operational advantage for attackers couldn't be clearer. Network traffic that appears identical to legitimate users provides enormous detection challenges. A successful VPN login that shows normal user behavior doesn't trigger alarm bells until the subsequent malicious activity begins.

Detection must therefore shift to examining what happens after authentication. Defenders should investigate login sources from unexpected hosting providers, unusual client identifiers, and atypical account behaviors immediately following connection. The ReliaQuest report highlighted automated reconnaissance followed by credential harvesting and lateral movement as common patterns once the initial VPN foothold is established.

The attack also demonstrates why perimeter security alone is insufficient. Firewalls and VPN gateways designed to be the first line of defense are being bypassed through a logic flaw in trusted protocols, not through network-level exploits that traditional security tools can easily detect.

What Defenders Should Do Now

Organizations running GlobalProtect services must act swiftly. The remediation path is clear but requires attention to detail. All GlobalProtect portals and gateways that generate or accept authentication override cookies must be upgraded to fixed versions. The vendor's advisory lists specific maintenance releases for each PAN-OS branch, and partial upgrades can create cookie compatibility problems between components.

If immediate patching isn't possible, Palo Alto Networks recommends disabling authentication override cookies entirely where not strictly required, or generating a dedicated certificate used exclusively for authentication override purposes. Shared certificates between portals, gateways, and other services increase exposure risk significantly.

Following any upgrade, administrators must terminate all active GlobalProtect sessions and require users to re-authenticate. Sessions established before remediation remain active and fully functional, making active session cleanup mandatory for effective remediation.

Investigation should extend to suspicious VPN sessions, particularly those involving hostnames like "kali" that have strong associations with malicious activity. Endpoint analysis for the observed tooling—Impacket, PsExec, log clearing utilities, and cloud storage access—should follow any confirmed compromise.

The Broader Context of AI-era threats

These developments occur alongside a broader shift in the cybersecurity landscape driven by AI capabilities. As discussed in recent CISA briefings, organizations are facing an expanding threat surface where authentication systems—once considered secure foundations—are under active attack. The GlobalProtect case exemplifies how infrastructure designed for security can be turned against its owners through seemingly minor design oversights in cookie validation.

For more on security best practices and threat intelligence, see cybersecurity. The latest guidance from industry groups continues to emphasize that patching critical vulnerabilities must happen within hours of disclosure, not weeks.

Conclusion

The CVE-2026-0257 GlobalProtect bypass represents a convergence of multiple critical security themes: the weaponization of authentication design flaws, the adaptability of ransomware operators, and the persistent challenge of detecting malicious activity hidden within legitimate traffic patterns. The fact that this vulnerability enables ransomware through a feature designed to improve user experience serves as a stark reminder that security by design requires more than perimeter hardening—it demands continuous validation of trust boundaries.

For organizations still running older PAN-OS versions, this is not a future risk—it is an active incident in progress. The 30-day remediation deadline set by CISA for federal agencies may seem aggressive, but the evidence shows that threat actors have been operating in the wild for months. The window for prevention closes the moment a ransomware operator successfully forges their first authentication cookie.

Organizations should also explore additional security layers, including hardware security modules for identity verification and zero-trust network access models that treat every connection as untrusted until explicitly verified. The era of trusting the network perimeter has passed; the era of verifying every request is here.

Images

MEMZ trojan ransomware on a MacBook Pro laptop - illustrative screenshot showing recursive image effect on a compromised endpoint

Network cables in server room infrastructure - representing the network pathways that VPN gateways protect

References