The VPN flaw ransomware groups keep using: CVE-2026-0257 explained

On 13 May 2026 Palo Alto Networks fixed CVE-2026-0257, a flaw in GlobalProtect, the VPN built into its firewalls. Four days later attackers were using it. By July it was being used in ransomware attacks, and on 19 October Palo Alto's own threat researchers, Unit 42, named two of the busiest ransomware groups, Qilin and INC, as exploiting it. This explainer covers what the flaw is, how to tell whether your firewall is exposed, and what to do, including after you have patched.

What the flaw is

GlobalProtect can hand a user's VPN client a cookie after a successful login, so the user does not have to log in again for a while. Palo Alto calls this an authentication override cookie. The flaw is that the firewall decrypts that cookie and trusts what is inside without checking that it really came from the firewall. Where the certificate used to encrypt the cookies is the same one the portal or gateway uses for its public HTTPS page, an attacker can create a cookie the firewall accepts and open a VPN session without a password, and so without multi-factor authentication either (Palo Alto Networks advisory, Rapid7).

The NVD rates it 9.1 out of 10, critical: it can be exploited over the internet, with no account and no user interaction (NVD). Palo Alto's own rating is 7.8 under the newer CVSS 4.0 scheme, with its urgency set to the highest level because it is being exploited. It affects PAN-OS firewalls and Prisma Access; Panorama and Cloud NGFW are not affected.

Are you exposed?

Two settings have to be in place, and neither is on by default:

• Authentication override cookies are switched on for the GlobalProtect portal or gateway (the "Generate cookie for authentication override" and "Accept cookie for authentication override" options).
• The certificate used to encrypt those cookies is also used for something else, typically the portal's or gateway's HTTPS service.

Many companies switch on override cookies so users are not asked to log in over and over, and reusing one certificate is a common shortcut. If you run GlobalProtect, check both settings on every portal and gateway, then check the PAN-OS version against the table below. If you are not sure, assume you are exposed: patching costs less than an investigation.

What happened, and when

• 13 May: Palo Alto publishes the advisory and the first fixes.
• 17 May: the earliest exploitation Rapid7 saw, with more waves on 18 and 21 May (BleepingComputer).
• 29 May: Palo Alto confirms exploitation, Rapid7 publishes its analysis, and the US agency CISA adds the flaw to its catalogue of exploited vulnerabilities (CISA).
• 1 June: Belgium's national cyber security centre warns that it is being exploited and urges organisations to patch immediately (CCB).
• July: Arctic Wolf links intrusions it investigated in June to the Qilin ransomware group, and CISA marks the flaw as used in ransomware campaigns (BleepingComputer).
• 19 October: Unit 42 names Qilin and INC as exploiting it, followed by detection guidance on 20 October (Unit 42). ReliaQuest also links it to the Settra ransomware group (Help Net Security).

Once inside, the attackers Unit 42 tracked followed a familiar ransomware pattern: remote-management tools to look around, RDP and SMB to move between machines, stealing credentials and data, then encrypting systems. In one case they went on to the company's VMware vCenter and ESXi servers, and some attacks also used an old flaw in Veeam backup software (CVE-2023-27532). We covered both groups' October activity in our ransomware round-up.

The fix

Upgrade to a fixed version from Palo Alto's advisory. Only use the versions in the advisory: some articles list other version numbers that do not match it.

Three things from Palo Alto's FAQ catch people out. Upgrade every portal and gateway, internal and external, because a partial upgrade breaks cookie compatibility. Expect every user to log in once more after the upgrade. And give the override cookies their own certificate, used for nothing else.

If you cannot upgrade straight away, Palo Alto's workaround is to do that last step now: use a dedicated certificate for the authentication override cookies, or switch the "Generate" and "Accept cookie for authentication override" options off on the portal and gateway.

After patching: check whether someone got in first

The flaw was exploited for months before ransomware groups were named, so a patched firewall may already have let someone in. Patching closes the door; it does not remove anyone who is inside. Unit 42, Rapid7 and ReliaQuest suggest these checks:

1. End all active GlobalProtect sessions after patching, so any session opened with a forged cookie is cut off.
2. Search the GlobalProtect logs for logins where the authentication method is "Cookie", especially for local accounts such as admin, and for logins from hosting providers rather than home or mobile connections.
3. Look for clients with placeholder details: host IDs such as aa:bb:cc:dd:ee:ff or 00:11:22:33:44:55, and device names such as WINDOWS-LAPTOP-001, DESKTOP-GP01, GP-CLIENT or kali.
4. Check that the firewall's management interface, including ports 4443 and 3879, cannot be reached from the internet.
5. If you find anything, treat it as a breach: look for remote-management tools, new accounts and unusual RDP or SMB traffic from VPN addresses, and protect your backups and virtualisation servers first.

Why it is still working

Palo Alto's advisory still describes "limited exploit attempts", and Rapid7 found that at many customers a forged cookie was accepted without a full VPN session being set up. But scale is not the point. Shadowserver and Shodan each count more than 167,000 GlobalProtect devices reachable from the internet (BleepingComputer), and only a small share needs to be unpatched and set up the vulnerable way for ransomware groups to keep finding them. Five months after the fix, they still are.

Sources: Palo Alto Networks, Unit 42, Rapid7, NVD, CISA and the reports linked in the text. Versions and advice were correct on 26 October 2026; check the advisory for updates.