A high-severity flaw in Palo Alto Networks' GlobalProtect VPN software is giving ransomware crews a direct path into corporate networks, letting them skip the login prompts and multi-factor checks that are supposed to stand between outsiders and sensitive systems. Unit 42, the company's threat intelligence arm, detailed the exploitation in an October 19 update, tying it to groups known as Spikey Scorpius (also called Qilin) and Tarnished Scorpius (also called Inc), with separate reporting linking the flaw to operators deploying Settra ransomware. Investigations into the activity have been running since early June and span healthcare, education, financial services, manufacturing, government, and energy organizations.
How the bypass actually works
The vulnerability, tracked as CVE-2026-0257, carries a CVSS score of 7.8 and affects GlobalProtect portals and gateways in certain PAN-OS and Prisma Access configurations, provided authentication override cookies are enabled alongside a particular certificate setup. Panorama and Cloud NGFW deployments are not affected. Those override cookies exist for convenience: they let a user who has already logged in reconnect without repeating the full authentication sequence, including MFA. According to technical analysis from Rapid7, the affected devices decrypt these cookies correctly but fail to confirm that a trusted system actually issued them. If the same certificate used to sign cookies is also exposed on a public-facing service, an attacker can lift its public key and forge a valid-looking cookie. The gateway then accepts it as proof of a completed login - no password, no second factor, no alert.
This is a trust-verification failure rather than a brute-force weakness, which is part of why it is so effective. MFA is designed to stop credential theft from translating into access. A forged session cookie sidesteps that entire defense by exploiting how the system remembers it has already authenticated someone, rather than attacking the authentication step itself.
From VPN foothold to domain controller theft
Once inside, attackers reportedly deploy remote monitoring and management tools to map internal networks, then move laterally using Remote Desktop Protocol and Server Message Block before setting up credential-harvesting and data-exfiltration tools ahead of ransomware deployment. The most striking case Unit 42 documented went further. Attackers pivoted from the compromised VPN gateway into VMware's vCenter management appliance, disabled the execInstalledOnly security control on ESXi hosts, and used a custom tool to pull credentials directly from a domain controller's virtual disk file - offline, without ever triggering the endpoint detection software running inside that virtual machine.
That technique matters because it targets the infrastructure layer beneath the operating system rather than the operating system itself. Security tools installed inside a virtual machine cannot see or stop something happening to the underlying disk file from outside. Unit 42 also found the same intrusion pattern paired with tools aimed at Veeam backup infrastructure through a separate, previously known flaw, CVE-2023-27532, which can expose encrypted credentials stored in backup configuration databases - potentially giving attackers a second route into backup hosts even after initial access is cut off.
What organizations should do now
Palo Alto Networks has published an advisory with patches for every affected portal and gateway configuration, rating the issue's suggested response urgency at its highest level. Where immediate patching is not possible, disabling authentication override entirely, or generating a certificate used exclusively for override cookies rather than shared with other services, closes the specific gap being exploited.
Defenders are also encouraged to review GlobalProtect logs for successful gateway connections tied to suspicious client details, since earlier monitoring found that many exploitation attempts never completed a full VPN session - meaning connection events, not just failed login attempts, are the signal worth chasing. Reported indicators include the IP addresses 104.207.144[.]154 and 146.19.216[.]125, device names GP-CLIENT and DESKTOP-GP01, and host identifiers aa:bb:cc:dd:ee:ff and 00:11:22:33:44:55.
- Patch all affected GlobalProtect portals and gateways per the vendor advisory.
- Disable authentication override cookies, or issue a dedicated certificate solely for that function.
- Audit GlobalProtect logs for anomalous successful connections, not just failed logins.
- Review ESXi configurations for disabled execInstalledOnly controls and unexpected vCenter access.
- Patch Veeam backup infrastructure against CVE-2023-27532 to limit secondary access paths.
The episode is a reminder that MFA, while valuable, is not an unconditional guarantee. Its strength depends entirely on the integrity of the systems that issue and verify session trust behind the scenes - and when that verification breaks down, attackers need only find the seam.