Five months after it was patched, a PAN-OS GlobalProtect authentication bypass has become one of ransomware’s favorite front doors. In an update published October 19, 2026, Palo Alto Networks’ Unit 42 said the Qilin (tracked as Spikey Scorpius) and INC (Tarnished Scorpius) ransomware operations are actively exploiting CVE-2026-0257, a CVSS 7.8 flaw in the GlobalProtect portal and gateway components of PAN-OS and Prisma Access, to bypass multi-factor authentication, open VPN sessions, and in at least one case pivot straight into VMware vCenter to steal domain-wide credentials. With public reporting also tying the flaw to Settra ransomware, any shop running GlobalProtect needs to treat this as a live incident-response question, not just a patching ticket. Here’s what’s happening and why it matters.
The Flaw: An Old Patch With New Victims
CVE-2026-0257 is an authentication bypass that lets an unauthorized attacker get around security controls and initiate VPN connections through vulnerable GlobalProtect portals and gateways. Palo Alto Networks patched it in May 2026, and CISA added it to the Known Exploited Vulnerabilities (KEV) catalog on May 13, 2026. A public proof of concept followed on May 29, and Unit 42 says its investigations into related intrusions have been running since early June.
The ransomware angle has been building for months. Arctic Wolf flagged Qilin’s use of the bug back in July 2026, and on October 9 ReliaQuest reported multiple groups, including Qilin and Settra, abusing it for initial access. Unit 42’s latest update confirms the trend and adds INC to the list. As ReliaQuest’s Brandon Tirado told Cybersecurity Dive, “About five months after disclosure, the flaw has become a reliable way into networks for ransomware groups, and that will likely continue over the next three months as more groups and access brokers adopt it.”
The Attack Chain: From VPN Session to Hypervisor
According to Unit 42, the playbook after a successful bypass looks like a classic hands-on-keyboard ransomware operation, just with a much quieter entrance:
- Initial access: Exploit CVE-2026-0257 and sidestep MFA to establish what looks like a normal GlobalProtect VPN session.
- Reconnaissance: Map the internal network using dual-use remote monitoring and management (RMM) tools.
- Lateral movement: Spread across the environment over RDP and SMB.
- Staging: Drop tooling for credential harvesting, data exfiltration, and ultimately ransomware deployment.
- Backup sabotage: Chain in older exploits such as the Veeam flaw CVE-2023-27532 to go after backup infrastructure.
Victims span a wide spread of sectors, including education, financial services, healthcare, manufacturing, government, professional and legal services, utilities and energy, and retail. In other words, if it has a GlobalProtect portal on the internet, it’s a target.
The Virtualization Pivot That Blinds EDR
The headline-grabbing detail is what happens after the attackers are inside. As Unit 42 put it, “The most significant evolution in tactics, techniques and procedures (TTPs) following successful exploitation of CVE-2026-0257 is the direct pivot to the virtualization layer.”
In one case, attackers moved from the compromised VPN gateway to the vCenter management appliance, disabled the execInstalledOnly security control on ESXi hypervisors, and then used a custom tool to perform offline credential dumping directly against a domain controller’s virtual disk (VMDK). Because the extraction happens at the storage layer rather than inside the guest operating system, in-guest EDR never gets a look at it. Think of it as robbing the vault by lifting the whole building off its foundation instead of picking the lock on the front door: every alarm inside stays silent.
What Techs Should Do Right Now
Palo Alto Networks recommends applying the fixes and workarounds in its CVE-2026-0257 security advisory, then proactively hunting for compromise and activating incident response for any suspicious successful gateway-connected events. Unit 42’s threat brief gives defenders a concrete starting checklist:
- Patch first: Confirm every PAN-OS firewall and Prisma Access deployment is on a fixed release per the vendor advisory, or has the documented mitigations in place.
- Hunt suspicious host IDs: Search GlobalProtect logs for successful gateway-connected events from any IP using placeholder values such as aa:bb:cc:dd:ee:ff, 00:11:22:33:44:55, WINDOWS-LAPTOP-001, DESKTOP-GP01, or GP-CLIENT.
- Match the PoC fingerprint: Look for connections reporting endpoint_os_version “Microsoft Windows 10 Pro 64-bit” with an empty source_user_info.domain, the hard-coded values from the public exploit.
- Check early IOCs: Review GlobalProtect logs for the pre-PoC attacker IP addresses Unit 42 published in its brief.
- Audit the virtualization layer: Verify execInstalledOnly is still enforced on ESXi hosts, review vCenter logins for sessions sourced from VPN address pools, and make sure Veeam servers are patched against CVE-2023-27532.
One important caveat: patching closes the door but doesn’t evict anyone already inside. If a gateway was exposed and unpatched at any point since May, assume a hunt is required.
Why It Matters
This campaign is a sharp reminder that MFA on the VPN is only as strong as the VPN itself. ReliaQuest warned that because the malicious activity originates from internal VPN address space, it can look exactly like a legitimate remote-access session and slip past monitoring tuned for external threats. Combine that with an attacker who skips the endpoint entirely and goes after the hypervisor, and many of the controls teams rely on most, from MFA prompts to EDR alerts, simply never fire.
For MSPs and internal IT teams alike, the lesson is that edge devices and virtualization management planes deserve the same monitoring attention as user endpoints, and that “patched in May” isn’t the same as “safe in October.”
Looking Ahead
If ReliaQuest’s forecast holds, more ransomware crews and initial access brokers will add CVE-2026-0257 to their toolkits over the next three months, which means unpatched or previously compromised GlobalProtect gateways will keep getting hit. Expect Unit 42 and other researchers to keep updating indicators as new groups join in.
The bigger trend to watch is the move to the virtualization layer. Attacks that dump credentials straight from VMDKs and switch off ESXi protections are a growing challenge for security stacks built around in-guest agents. Teams that lock down vCenter access, segment management networks away from VPN pools, and alert on hypervisor configuration changes will be far better positioned when the next edge-device bug lands.
Sources:
- Palo Alto Networks Unit 42, October 19, 2026
- The Hacker News, October 20, 2026
- Cybersecurity Dive, October 20, 2026
