Ransomware crews are logging in through GlobalProtect VPNs without passwords. Upgrade and reset sessions today

If your remote staff connect through Palo Alto Networks GlobalProtect, a ransomware crew may be able to connect the same way without a username or password. ReliaQuest warned on October 9 that the Qilin and Settra ransomware groups are using CVE-2026-0257, an authentication bypass in GlobalProtect, to open VPN sessions that look like ordinary remote work.

Palo Alto fixed the bug on May 13. Five months later, enough firewalls are still unpatched that two separate ransomware operations find it worth their time.

The attacker logs in through your own VPN, so on Monday morning they look like one more remote worker.

The 5-Minute Cyber Brief

Don’t Miss the Policy Changes That Affect Security Decisions

Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.

Email addressSend me tomorrow’s brief

By subscribing you agree to our Privacy Policy.

Free. Weekday mornings. 5 minutes or less.

Qilin and Settra are opening GlobalProtect VPN sessions without passwords

CVE-2026-0257 lets an attacker skip GlobalProtect portal and gateway authentication and establish a VPN connection. Palo Alto rates it 7.8 (High) under CVSS 4.0 with its highest suggested urgency, and lists the exploit maturity as “Attacked.” CISA added it to the Known Exploited Vulnerabilities catalog on May 29, 2026, and marks it as known to be used in ransomware campaigns.

ReliaQuest’s update, reported by Infosecurity Magazine and Cyber Security News over the weekend, adds:

• Two ransomware groups. Qilin and Settra are both using the flaw for initial access.
• Post-access tooling. Cobalt Strike, BloodHound and SharpHound followed the VPN sessions.
• A forecast. ReliaQuest called it “highly likely” that exploitation continues over the next three months.

Who runs GlobalProtect with override cookies

Exposure depends on configuration. A firewall is affected when a GlobalProtect portal or gateway has authentication override cookies enabled and a specific certificate configuration exists. Panorama and Cloud NGFW are not affected. Prisma Access tenants are being upgraded by Palo Alto on a published schedule, but hybrid Prisma Access setups still need their on-premises firewalls upgraded.

Detection is the hard part. A forged cookie produces a successful login, not a failed one, so password-spray alerts never fire. ReliaQuest’s warning is that patching alone does not remove a session or foothold opened before the fix.

Upgrade every portal and gateway, then end every session

• Check each portal (Network > GlobalProtect > Portals > Agent > Authentication) and gateway (Client Settings > Authentication Override) for “Generate cookie” or “Accept cookie for authentication override.” Note which boxes have it on.
• Upgrade every internal and external portal and gateway to a fixed release, for example 12.1.7, 11.2.12, 11.1.15 or 10.2.18-h6 (see the full table below). Upgrade them together to avoid cookie mismatches.
• If you cannot upgrade today, turn off authentication override, or move it to a newly generated certificate used for nothing else.
• After the upgrade, terminate all active GlobalProtect sessions. Users will have to sign in again once; warn the help desk first.
• Review recent VPN sessions for devices you do not recognize, including hostnames such as “kali,” and follow any of them into the network.

Details

• CVE: CVE-2026-0257, GlobalProtect portal and gateway authentication bypass (CWE-565, reliance on cookies without validation). Published May 13, 2026; updated June 3, 2026.
• KEV: added May 29, 2026 (federal due date June 1, 2026); ransomware use: Known.
• Fixed releases: PAN-OS 12.1.4-h6 / 12.1.7; 11.2.4-h17 / 11.2.7-h14 / 11.2.10-h7 / 11.2.12; 11.1.4-h33 / 11.1.6-h32 / 11.1.7-h6 / 11.1.10-h25 / 11.1.13-h5 / 11.1.15; 10.2.7-h34 / 10.2.10-h36 / 10.2.13-h21 / 10.2.16-h7 / 10.2.18-h6. Prisma Access 10.2.10-h36 and 11.2.7-h13.
• Not affected: Panorama, Cloud NGFW.
• Phased upgrades: set global-protect enable-auth-override-cookie-hmac no keeps older cookies working during a mixed-version rollout. Set it back to yes once every portal and gateway is upgraded.
• Reported actors: Qilin, Settra (ReliaQuest, October 9, 2026).

Hunt / verify

• GlobalProtect logs: sessions with no matching identity-provider or MFA event, and endpoints with hostnames like “kali.”
• Hosts reached from VPN address pools running BloodHound or SharpHound collection, or beaconing like Cobalt Strike.
• New local or domain admin accounts created from VPN-assigned addresses since May.
• Palo Alto’s Unit 42 threat brief lists indicators for this CVE; load them before you go hunting.

Slack paste: GlobalProtect CVE-2026-0257 (fixed May 13, KEV, ransomware: Known): Qilin and Settra opening VPN sessions without creds (ReliaQuest, Oct 9). Action: check auth override cookie settings, upgrade every portal + gateway (e.g. 12.1.7 / 11.2.12 / 11.1.15 / 10.2.18-h6), then kill all GP sessions and review odd hostnames like “kali.”

Sources

• Palo Alto Networks: CVE-2026-0257 PAN-OS GlobalProtect authentication bypass advisory
• Unit 42: Active exploitation of PAN-OS CVE-2026-0257
• Infosecurity Magazine: Old Palo Alto VPN vulnerability remains a target for ransomware groups (ReliaQuest)
• Cyber Security News: Ransomware actors exploiting Palo Alto GlobalProtect flaw (October 11, 2026)
• CISA: Known Exploited Vulnerabilities catalog

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].