CVE-2026-0257: Authentication Bypass in PAN-OS Actively Exploited by Ransomware Groups

On October 12, 2026, the threat surrounding CVE-2026-0257 resurfaced with new urgency. Ransomware groups, including Qilin and Settra, are actively exploiting an authentication bypass in the GlobalProtect portal and gateway components of Palo Alto Networks PAN-OS to establish unauthorized VPN sessions and infiltrate corporate networks. The vulnerability, which requires no valid credentials, turns the perimeter device from a protective asset into a disguised entry point.

The Bypass Mechanism: Authentication Bypassed, Not Broken

The flaw resides in GlobalProtect's "Authentication Override" mechanism. When this configuration is active alongside a vulnerable certificate, an attacker can establish a VPN connection without presenting valid credentials. This is not password theft or cracking: authentication is simply bypassed.

The result is a VPN session with the same access level as a legitimate user. Traffic traverses the organization's VPN infrastructure, generating logs of "successful gateway-connected events" that mimic ordinary remote work. This is the core problem for Security Operations Centers: the security event that should signal authorized access becomes a blind spot instead.

Affected PAN-OS versions include 12.1, 11.2, 11.1, and 10.2 prior to the specific patches. Panorama and Cloud NGFW are explicitly excluded from impact. The exposure condition requires the vulnerable combination of Authentication Override plus certificate, a circumstance that reduces the attack surface but does not lessen severity where present.

From Compromised VPN to Ransomware: The Post-Exploitation Chain

Once inside, documented ransomware operators show differentiated tradecraft. According to Arctic Wolf Labs investigations of June 2026 intrusions, post-exploitation activities include reconnaissance tools such as BloodHound and SharpHound to map Active Directory, persistence via registry Run keys, redundant remote access with AnyDesk, Ngrok, LogMeIn, and MeshAgent, and lateral movement via PsExec.

Credential harvesting occurs through LSASS dumps and NTDS extraction, followed by exfiltration with Rclone to cloud services like MEGA. The final payload is Qilin ransomware. ReliaQuest also observed the use of Cobalt Strike in its context, indicating that tactical variability depends on the affiliate or access broker involved.

A recurring indicator in suspicious sessions is the hostname "kali," reported by both ReliaQuest and Arctic Wolf Labs. Unit 42 also identified specific host IDs, MAC addresses, and client configuration values associated with exploit attempts. These elements represent investigative leads, not definitive proof of compromise.

Why Detection Fails: The Paradox of the "Successful Login"

The key technical angle of this story is detection. The unauthorized VPN session generates exactly the same success events as a legitimate session. The attacker leaves no traces of brute force, triggers no credential-stuffing alarms, and produces no authentication anomalies. The firewall reports "gateway-connected" and the SOC, if relying on rules based on failed authentication, sees nothing.

This scenario demands a recalibration of detection: shift focus from authentication success to device and context legitimacy. Anomalous geolocation, unusual hours, absence of endpoint profile history, combination of suspicious hostnames like "kali" with directory enumeration activity: these are the new parameters security teams must focus on when GlobalProtect is exposed.

The source does not specify whether published indicators are complete nor how many organizations were actually compromised during 2026. The specific scale of ransomware activity in October compared to campaigns already observed in June-July also remains undocumented.

Immediate Actions

Operational actions derive directly from the analyzed sources:

• Immediate patching on all affected PAN-OS GlobalProtect instances, prioritizing systems with Authentication Override enabled.
• Explicit termination of all active GlobalProtect sessions after patching, as recommended by ReliaQuest: the code fix does not interrupt pre-existing sessions.
• Forensic investigation on "gateway-connected" logs from recent months, focusing on anomalous hostnames, host ID/MAC patterns, and subsequent reconnaissance or lateral movement activity.
• Reassessment of GlobalProtect internet exposure: where not strictly necessary, reducing the attack surface remains the most effective control.

"ReliaQuest assesses that the likelihood of exploitation will remain high over the next three months as ransomware groups and initial access brokers target unpatched systems" — ReliaQuest (via GBHackers)

The Broader Context: Edge VPN Devices as Priority Targets

The story of CVE-2026-0257 fits a consolidated pattern. Edge VPN devices — firewalls, SSL gateways, remote access appliances — have been priority targets for ransomware groups and initial access brokers for years. Exploitation persists months after patch availability because these systems, often managed with longer maintenance cycles, remain exposed.

The difference from other perimeter vulnerabilities lies in the concealment mechanism. An RCE on an exposed web service typically produces detectable anomalies. An authentication bypass on VPN produces traffic that looks legitimate by design. This is the false sense of security the headline evokes: the "successful VPN login" no longer guarantees legitimacy when the VPN itself is the vulnerability.

Arctic Wolf Labs documented that variability in post-exploitation tradecraft, "from encryption-only operations to full double-extortion," confirms the critical point for defenders remains the perimeter compromise. Everything that follows — reconnaissance, persistence, exfiltration, encryption — is a consequence of a flaw that could have been closed five months ago.

For the industry, the message is that patch availability does not equal remediation. A process that includes session termination, log verification, and active hunting is required. Otherwise, the gap between patch and active exploitation — here measured from May to October 2026 and beyond — will continue to favor threat actors.

Frequently Asked Questions

Is my organization vulnerable if it uses GlobalProtect without Authentication Override?

No. According to the vendor advisory, the vulnerability requires a specific configuration with Authentication Override enabled and a vulnerable certificate. Panorama and Cloud NGFW are excluded.

Why did CISA add CVE-2026-0257 to the KEV catalog?

CISA added the vulnerability to the Known Exploited Vulnerabilities catalog on May 29, 2026, confirming in-the-wild exploitation based on evidence from Unit 42 and other threat intelligence sources.

Are "successful gateway-connected" logs always suspicious now?

No. Most legitimate sessions generate the same event. The key is correlating with anomalous indicators: hostnames like "kali," unusual geolocation, post-authentication reconnaissance or lateral movement activity.

Sources

• https://gbhackers.com/ransomware-hackers-exploit-palo-alto-networks-globalprotect/amp/
• https://gbhackers.com/ransomware-hackers-exploit-palo-alto-networks-globalprotect/
• https://cyberupdates365.com/palo-alto-globalprotect-flaw-vpn-access/
• https://cybersecuritynews.com/cve-2026-0257-qilin-ransomware/
• https://securityaffairs.com/195730/cyber-crime/qilin-ransomware-affiliates-abuse-cve-2026-0257-to-gain-unauthorized-vpn-access.html
• https://security.paloaltonetworks.com/CVE-2026-0257
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• https://unit42.paloaltonetworks.com/active-exploitation-of-pan-os-cve-2026-0257/
• https://gbhackers.com/what-does-apexguard-vpn-actually-do-the-basics-explained/

Information verified against cited sources and current as of publication.

Sources