Ransomware Hackers Exploit Palo Alto Networks GlobalProtect VPN Authentication Bypass Vulnerability

Ransomware operators are actively exploiting CVE-2026-0257, an authentication bypass vulnerability affecting Palo Alto Networks PAN-OS GlobalProtect and Prisma Access.

It lets them establish unauthorized VPN sessions and infiltrate internal networks. ReliaQuest has identified multiple threat groups leveraging this flaw, including the Qilin and Settra ransomware operations.

These attacks use a trusted remote-access pathway rather than relying solely on suspicious external connections. Because intruders gain access through an organization’s own VPN infrastructure, their activities can mimic legitimate remote work, potentially delaying detection until phases such as credential theft, lateral movement, data exfiltration, or ransomware deployment begin.

Palo Alto Networks VPN Vulnerability

Palo Alto Networks describes the vulnerability as an authentication bypass affecting the GlobalProtect portal and gateway components. Successful exploitation enables attackers to bypass security measures and establish unauthorized VPN connections.

The risk depends on specific configuration settings: authentication override cookies must be enabled along with a certain certificate configuration. Note that Panorama and Cloud NGFW are not affected.

This configuration requirement matters because having GlobalProtect installed does not automatically indicate vulnerability. Administrators should assess their portal and gateway settings per the vendor advisory, rather than assume every deployment has the same level of exposure. The vulnerable authentication mechanism lets attackers gain network access without completing the usual authentication process.

ReliaQuest has also observed Cobalt Strike, BloodHound, and SharpHound being used in related activities. These findings accompany their warning that unauthorized VPN access can precede credential theft, internal movement, data theft, and ransomware execution. Not every intrusion involves all three tools or follows the same attack sequence.

Investigators should scrutinize unexpected GlobalProtect connections, including sessions linked to hostnames like “kali.” ReliaQuest specifically highlights this hostname as a lead for investigation; however, it should be evaluated alongside connection history and other evidence rather than being treated as definitive proof of attribution.

Organizations should upgrade affected deployments as soon as possible and disable authentication override cookies when they are not necessary.

ReliaQuest also recommends terminating all active GlobalProtect sessions after patching and examining unexpected connections. Updating vulnerable software alone may not eliminate access established before remediation.

It’s crucial to distinguish between addressing the vulnerability and removing existing access. Incident response must address both the exposed VPN configuration and any sessions attackers may have already established.

ReliaQuest assesses that the likelihood of exploitation will remain high over the next three months as ransomware groups and initial access brokers target unpatched systems.

Indicators of Compromise

ReliaQuest published the following indicators, though it did not detail their specific operational roles in the update. The final entry is listed as an address, not extended into an assumed subnet. These indicators should assist investigations alongside the reported VPN activity.

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.