A newly disclosed authentication bypass in Palo Alto Networks' PAN-OS GlobalProtect and Prisma Access products is now being actively exploited by ransomware operators, according to threat intelligence firm ReliaQuest. The flaw, tracked as CVE-2026-0257, allows attackers to establish unauthorized VPN sessions and walk directly into internal corporate networks without completing normal authentication. Among the groups identified leveraging the bug are the Qilin and Settra ransomware operations, both known for aggressive data theft and extortion campaigns.
What makes this vulnerability especially dangerous is the pathway it exploits. Rather than probing for weaknesses from the outside, attackers are walking through the same trusted remote-access doorway that employees use every day. VPN connections are generally assumed to be secure precisely because they are supposed to require proper credentials, which is why this flaw is so effective at evading early detection. The irony is not lost on security professionals: the very technology organizations rely on for secure remote work, and the kind of protection on hotel and airport Wi-Fi that traveling employees depend on, is being turned into an entry point when enterprise-grade implementations are misconfigured.
How the Bypass Works
Palo Alto Networks describes CVE-2026-0257 as an authentication bypass affecting the GlobalProtect portal and gateway components. Successful exploitation lets an attacker skip the standard login sequence entirely and establish a VPN session as though they were a legitimate user. Crucially, the vendor notes that exposure depends on specific configuration choices: the vulnerability requires authentication override cookies to be enabled alongside a particular certificate setup. Panorama and Cloud NGFW deployments are not affected. This means simply running GlobalProtect does not automatically place an organization at risk - administrators need to review their actual portal and gateway settings against the vendor's advisory rather than assume uniform exposure across their environment.
What Happens After the Breach
ReliaQuest's investigation found that once attackers gain unauthorized VPN access, their activity can closely resemble ordinary remote work, which delays detection considerably. The firm has observed follow-on use of tools including Cobalt Strike, BloodHound, and SharpHound in connection with these intrusions, suggesting a familiar progression toward credential theft, lateral movement, data exfiltration, and eventual ransomware deployment. Not every case follows the same sequence or involves all three tools, but the pattern is consistent enough to warrant close scrutiny of any unexpected GlobalProtect session. ReliaQuest specifically flags sessions tied to hostnames like "kali" as worth investigating, though this detail should be weighed alongside connection history and other evidence rather than treated as conclusive proof of who is behind an intrusion.
Remediation Requires More Than a Patch
Organizations running affected PAN-OS deployments are urged to upgrade immediately and disable authentication override cookies wherever they are not strictly necessary. ReliaQuest stresses a point that is easy to overlook: patching the vulnerability does not remove access that attackers may have already established. Incident response teams need to terminate all active GlobalProtect sessions after remediation and examine logs for connections that do not match expected user behavior. Addressing the underlying flaw and removing any foothold attackers gained beforehand are two distinct tasks, and skipping either one leaves an organization exposed.
- Upgrade PAN-OS GlobalProtect and Prisma Access to patched versions without delay
- Disable authentication override cookies unless operationally required
- Terminate all active VPN sessions following remediation
- Audit connection logs for anomalous hostnames and session patterns
- Cross-reference published indicators of compromise with internal telemetry
ReliaQuest assesses that exploitation of this flaw will likely remain high over the coming months, as ransomware affiliates and initial access brokers continue scanning for unpatched systems. The firm has also published a short list of indicator IP addresses tied to the observed activity, though it has not detailed their precise operational function within the attacks. Given how central VPN infrastructure has become to both enterprise security and everyday remote work, this incident is a reminder that trusted access points deserve the same scrutiny traditionally reserved for the open internet.