NewsCompaniesFlawsGuides
Get the app
HighPartly fixedBeing used in attacksUpdated

Palo Alto Networks GlobalProtect VPN sign-in bypass CVE-2026-0257 exploited by ransomware gangs

Attackers are using a GlobalProtect VPN flaw to enter business networks without valid credentials, including for ransomware. Ask IT to install the correct PAN-OS fix, confirm Prisma Access upgrades and investigate suspicious VPN connections.

What to do

If your business or family office uses GlobalProtect, ask IT to update every portal and gateway to the fixed release for its branch listed below and confirm the Prisma Access upgrade status. Until updated, administrators should disable Authentication Override in both portal and gateway settings. Ask them to investigate suspicious VPN connections using Unit 42’s guidance.

What’s happening

CVE-2026-0257 lets attackers establish unauthorised GlobalProtect VPN connections to affected business networks without valid credentials. Exposure requires authentication override cookies and a particular certificate configuration. Palo Alto Networks disclosed the flaw on 13 May; Rapid7 traced exploitation to 17 May. Arctic Wolf subsequently linked June intrusions to Qilin ransomware, including cases involving stolen data. In October, Palo Alto Networks’ Unit 42 identified both Qilin and INC operators exploiting the flaw and bypassing multi-factor authentication. PAN-OS fixes are available across the listed branches. Overall patch status remains partial because the vendor still describes Prisma Access customer upgrades as a scheduled rollout, without confirming completion. As at 3 November, the latest substantive vendor threat update reviewed is from October; it does not declare the attacks over.

What
Flaw
Affects
Palo Alto Networks PAN-OS GlobalProtect VPN and Prisma Access
Affected
Exposure requires a GlobalProtect portal or gateway with authentication override cookies enabled and a specific certificate configuration.
PAN-OS 12.1: before the applicable fixed release, 12.1.4-h6 or 12.1.7.
PAN-OS 11.2: before the applicable fixed release, 11.2.4-h17, 11.2.7-h14, 11.2.10-h7 or 11.2.12.
PAN-OS 11.1: before the applicable fixed release, 11.1.4-h33, 11.1.6-h32, 11.1.7-h6, 11.1.10-h25, 11.1.13-h5 or 11.1.15.
PAN-OS 10.2: before the applicable fixed release, 10.2.7-h34, 10.2.10-h36, 10.2.13-h21, 10.2.16-h7 or 10.2.18-h6.
Prisma Access 10.2.0: before 10.2.10-h36.
Prisma Access 11.2.0: before 11.2.7-h13.
Fixed in
PAN-OS 12.1: 12.1.4-h6 or 12.1.7 and later, as applicable.
PAN-OS 11.2: 11.2.4-h17, 11.2.7-h14, 11.2.10-h7 or 11.2.12 and later, as applicable.
PAN-OS 11.1: 11.1.4-h33, 11.1.6-h32, 11.1.7-h6, 11.1.10-h25, 11.1.13-h5 or 11.1.15 and later, as applicable.
PAN-OS 10.2: 10.2.7-h34, 10.2.10-h36, 10.2.13-h21, 10.2.16-h7 or 10.2.18-h6 and later, as applicable.
Prisma Access 10.2: 10.2.10-h36 and later; customer rollout completion unconfirmed.
Prisma Access 11.2: 11.2.7-h13 and later; customer rollout completion unconfirmed.
CVE
CVE-2026-0257
Since
13 May 2026

Timeline

  1. Wider attacks

    Unit 42 identified Qilin and INC ransomware operators exploiting the flaw to enter corporate networks and bypass multi-factor authentication. Its investigations had continued since early June across numerous industries.

  2. Wider attacks

    Arctic Wolf reported multiple June intrusions that began with this flaw and ended in Qilin ransomware encryption. Some also involved data theft and extortion.

  3. Vendor revisedPartly fixed

    The vendor added upgrade FAQs requiring all cookie-sharing GlobalProtect portals and gateways to be updated. Its advisory lists fixed releases but describes Prisma Access customer upgrades as an ongoing scheduled rollout.

  4. Vendor revised

    Palo Alto Networks acknowledged limited exploitation attempts against unpatched devices without mitigations. Rapid7 reported that the vendor raised its severity score from 4.7 to 7.8.

  5. CISA added

    CISA added the flaw to its exploited-vulnerability catalogue, which now records known ransomware use. Unit 42 gives 13 May as the listing date, but CISA’s own entry says 29 May.

  6. Wider attacks

    Rapid7 later identified this as its earliest observed exploitation date. It found successful exploitation across several customers, but initially found no evidence of attackers moving further through their networks.

  7. Made public

    Palo Alto Networks disclosed CVE-2026-0257, a GlobalProtect VPN sign-in bypass affecting particular PAN-OS and Prisma Access configurations.

Sources

  1. CVE-2026-0257 PAN-OS: GlobalProtect Authentication Bypass VulnerabilitiesPalo Alto Networks · 3 June 2026
  2. CISA Known Exploited Vulnerabilities catalogue — 3 November 2026 editionCISA · 3 Nov 2026
  3. Rapid7 Observed Exploitation of PAN-OS GlobalProtect Authentication Bypass Vulnerability (CVE-2026-0257)Rapid7 · 3 June 2026
  4. Cookie Crumbles: How Exploitation of CVE-2026-0257 Leads to Qilin RansomwareArctic Wolf Labs · 20 July 2026
  5. Active Exploitation of May 2026 PAN-OS CVE-2026-0257 (Updated October 20)Palo Alto Networks Unit 42 · 20 Oct 2026
HARD Live follows this until it’s over: each change is added to the timeline with its source. Everything live · Everything from May 2026 · JSON · RSS