#CVE-2026-0257

Ransomware Crews Exploit Unpatched Palo Alto GlobalProtect Auth Bypass to Blend With Legitimate Remote Traffic

Threat actors associated with the Qilin and Settra ransomware operations are actively exploiting CVE-2026-0257 to bypass authentication on Palo Alto Networks PAN-OS GlobalProtect and Prisma Access appliances. Disclosed back in May 2026, the vulnerability carries an initial CVSS score of 7.8 from the vendor alongside a critical 9.1 rating assigned by the National Vulnerability Database. The flaw specifically compromises the GlobalProtect portal and gateway subsystems, giving external adversaries an avenue to initiate fully authenticated VPN tunnels without going through proper credentials validation. Exposure relies heavily on particular device configurations, specifically requiring the activation of authentication override cookies in tandem with a distinct certificate setup. Deployments managed via Panorama or running on Cloud NGFW remain entirely unaffected by this flaw. Once authenticated through the edge gateway, attackers appear in connection logs virtually indistinguishable from regular remote employees, masking their reconnaissance until malicious tooling appears downstream. Post-exploitation activities linked to these intrusions feature common enterprise assessment and movement tools, namely Cobalt Strike, BloodHound, and SharpHound. Investigators have flagged anomalous connection metadata, notably connecting sessions advertising the default OS hostname "kali", as initial leads during telemetry analysis. Security researchers track multiple operational IP addresses leveraged during these sweeps, including `216.245.184.150`, `216.245.184.47`, `216.245.184.110`, and `216.245.184.0`. While CISA previously mandated US federal agency remediation by June 1 after listing the bug on its Known Exploited Vulnerabilities catalog, exploitation attempts have persisted steadily across multiple intelligence teams from late May through October. Researchers warn that unpatched environments will likely face continued initial-access exploitation attempts from ransomware brokers over the coming quarter.