Key takeaways
- CVE-2026-0257 is an authentication bypass in the GlobalProtect portal and gateway of PAN-OS. An attacker can forge an authentication cookie and open a VPN session without valid credentials or MFA (Palo Alto advisory).
- What changed this week: on 19 and 20 October 2026, Palo Alto's Unit 42 updated its threat brief to link the bug to Qilin and Inc ransomware operations, with attackers moving from the VPN to vCenter, ESXi and domain controllers (Unit 42).
- You are only exposed if a specific, non-default setting is on: authentication override cookies enabled, and the cookie certificate reused for another service such as the portal's HTTPS certificate (Rapid7).
- Fixes have been out since May. If you patched then, your job now is to hunt for logins that happened before the patch. If you didn't, patch today or switch the setting off.
- Severity was raised from 4.7 to 7.8 (high) after a public proof of concept appeared on 29 May. Rapid7 recommends treating it as critical, because it is a pre-auth bypass on an internet-facing VPN.
1. What the bug is, in plain terms
GlobalProtect can issue an "authentication override" cookie so a user doesn't have to re-enter credentials every time they reconnect. PAN-OS encrypts that cookie with a certificate you choose. If the same certificate also serves the portal's or gateway's public HTTPS, an attacker can use what is publicly visible to craft a cookie the firewall accepts as genuine. The result is a VPN session, often as the local admin user, with no password and no MFA prompt.
Palo Alto disclosed the issue on 13 May 2026. Rapid7's managed detection team saw exploitation from 17 May. After Rapid7 published its analysis and proof of concept on 29 May, Palo Alto raised the score and CISA added the bug to its Known Exploited Vulnerabilities catalogue.
| Detail | Value |
|---|---|
| Component | GlobalProtect portal and gateway (PAN-OS, Prisma Access) |
| Type | Authentication bypass, pre-auth, network-reachable |
| Score | 7.8 high (raised from 4.7) |
| First exploitation seen | 17 May 2026 (Rapid7) |
| Public PoC | 29 May 2026 |
| Not affected | Cloud NGFW |
| Latest change | 19–20 Oct 2026: ransomware link, remediation guidance (Unit 42) |
2. Why the October update matters
In May and June, most observed attempts got a cookie accepted but didn't go further. Rapid7 saw no lateral movement then. The October update to the Unit 42 brief changes that picture. It describes:
- VPN access followed by internal recon using legitimate remote monitoring and management (RMM) tools, which blend in with normal IT activity.
- Lateral movement over RDP and SMB, then staging tools for credential theft, data exfiltration and ransomware.
- One intrusion that pivoted to vCenter, disabled an ESXi protection setting (
execInstalledOnly), and pulled credentials offline from a domain controller's virtual disk. Doing it this way avoids the EDR agent running inside Windows. - Chaining with an old Veeam bug (CVE-2023-27532). Backup servers are a favourite target because wiping backups is what forces victims to pay.
The named groups are Qilin and Inc, and public reporting also mentions a third, Settra. Targets include education, financial services, healthcare, government, manufacturing and utilities. Plenty of Indian mid-size firms in those sectors run Palo Alto firewalls, often with GlobalProtect for remote staff.
3. Are you affected? Check the version and the setting
First check the version (Device → Dashboard → General Information, or show system info in the CLI). Fixed releases, per the advisory as summarised by Arctic Wolf:
| Train | Upgrade to at least (any one of) |
|---|---|
| PAN-OS 12.1 | 12.1.4-h6 or 12.1.7 |
| PAN-OS 11.2 | 11.2.4-h17, 11.2.7-h14, 11.2.10-h7 or 11.2.12 |
| PAN-OS 11.1 | 11.1.4-h33, 11.1.6-h32, 11.1.7-h6, 11.1.10-h25, 11.1.13-h5 or 11.1.15 |
| PAN-OS 10.2 | 10.2.7-h34, 10.2.10-h36, 10.2.13-h21, 10.2.16-h7 or 10.2.18-h6 |
| Prisma Access 11.2 | 11.2.7-h13 |
| Prisma Access 10.2 | 10.2.10-h36 |
Pick the hotfix on the maintenance release you already run. That's usually a smaller change than jumping trains. If you're on a train older than 10.2, you're on unsupported software anyway and that's a bigger problem than this one CVE.
Then check the setting. In the GlobalProtect portal and gateway configs, look at the Agent → Authentication settings for "Generate cookie for authentication override" and "Accept cookie for authentication override", and note which certificate is selected for encrypting and decrypting the cookie. If override is on and that certificate is also your portal or gateway SSL/TLS certificate, you meet the exploit conditions.
4. Patch, or apply the workaround tonight
| Option | Downtime | Closes the bug? | When to use |
|---|---|---|---|
| Install fixed hotfix | One reboot (5–20 min per firewall; HA pairs one at a time) | Yes | Default. Do it in the next maintenance window |
| Disable auth-override cookies | None, but users re-authenticate more often | Yes, for this path | Tonight, if you can't patch for days |
| Dedicated certificate for cookies | None | Yes, for this path | If users rely on override and can't lose it |
| Restrict GlobalProtect by source IP or geo | None | Reduces exposure only | Extra layer; hard for staff who travel |
Unit 42 also flags a related exposure. Some organisations bind GlobalProtect or HTTPS services to the management interface, which ends up reachable from the internet on ports such as 4443 and 3879. From a phone on mobile data, try to open those ports on your firewall's public and management IPs. If anything answers, lock it down with an Interface Management profile that allows only your admin subnets.
5. Hunt: patching does not undo a break-in
If the firewall was vulnerable at any point after mid-May, assume someone may have tried. Search the GlobalProtect logs (Monitor → Logs → GlobalProtect) from 13 May onwards for:
- Successful logins from the IPs Unit 42 published. These include 104.207.144[.]154, 146.19.216[.]119/120/125, 179.43.172[.]213, 185.195.232[.]139, 198.12.106[.]60 and 202.144.192[.]47. Take the full list from the brief.
- Placeholder device details in gateway-connected events: MAC
aa:bb:cc:dd:ee:ffor00:11:22:33:44:55, or host names likeDESKTOP-GP01,GP-CLIENTorWINDOWS-LAPTOP-001. - The proof of concept's fingerprint: OS reported as "Microsoft Windows 10 Pro 64-bit" with an empty user domain field.
- Any VPN login as
adminor another local firewall account. Real users should come in through LDAP, RADIUS or SAML.
If you find a hit, treat it as an incident and not a ticket. Disconnect the session, rotate local and domain admin passwords, look for new RMM tools (AnyDesk, ScreenConnect and similar), check vCenter and ESXi for setting changes, and confirm that an offline or immutable backup exists before anyone touches production.
6. The India angle: six hours, and the DPDP Act
- CERT-In's April 2022 directions require reportable cyber incidents, including unauthorised access and ransomware, to be reported within six hours of noticing them. Have the CERT-In reporting contact and format ready before you start hunting.
- The DPDP Act, 2023 expects "reasonable security safeguards" for personal data. An edge VPN left on a known-exploited bug for five months is hard to defend.
- Cost reality: for a typical SME with one HA pair, patching takes an engineer two to four hours, and the hunt another half day. Compare that with a ransomware recovery, which can mean days or weeks of rebuilding servers and restoring data.
- Support contract check: hotfix downloads need an active support entitlement. If renewal lapsed, the workaround (disable cookies or use a dedicated certificate) costs nothing and closes this path while procurement catches up.
Bottom line
Check two things today: the PAN-OS version, and whether auth-override cookies share a certificate with your portal. Patch or switch the setting off. Then spend an hour in the GlobalProtect logs going back to May. The October ransomware link means "we patched eventually" is no longer the end of the story.
Want a second pair of eyes on firewall logs, or a 24×7 watch on your VPN and vCenter? See our NOC/SOC setup and incident monitoring services. For another edge risk to close this month, read Windows Server 2012 is now fully unpatched.