Ransomware groups exploit PAN-OS flaw CVE-2026-0257 to bypass MFA
Original title: Hackers Exploit Palo Alto Networks PAN-OS Flaw to Bypass MFA and Deploy Ransomware
Unit 42 says the GlobalProtect cookie bug yielded VPN access and later ransomware across several sectors since early June 2026.
Unit 42’s October 19 update says Spikey Scorpius, also called Qilin, and Tarnished Scorpius are exploiting CVE-2026-0257 in Palo Alto Networks PAN-OS. The GlobalProtect portal and gateway flaw, scored CVSS 7.8, requires authentication-override cookies and a specific certificate setup. Attackers then used RDP, SMB, credential theft, and ransomware; public reports also cite Settra. Panorama and Cloud NGFW are not affected. Palo Alto advises fixed releases or disabling authentication override.
Unconfirmed: Unit 42 attributes the activity to named groups; public reports, not Unit 42 alone, link some attacks to Settra.
- Affected sectors include healthcare, education, finance, government, manufacturing, and energy.
- One case reached vCenter, disabled ESXi execInstalledOnly, and stole credentials from a VMDK.
- Some intrusions also used Veeam backup flaw CVE-2023-27532.
- Unit 42 lists suspicious client IDs and three historical source addresses.
- Fixed releases regenerate cookies, forcing users to authenticate again.
Impact: MFA bypass, unauthorized VPN access, and ransomware deployment
| Product | Affected | Fixed in |
|---|---|---|
| Palo Alto Networks PAN-OS GlobalProtect portal and gateway | — | latest fixed releases |
| Veeam backup infrastructure | — | — |
- 1.Upgrade affected GlobalProtect portals and gateways to the latest fixed releases.
- 2.Disable authentication override or issue a new certificate for override cookies.
- 3.Review GlobalProtect logs for the listed suspicious client identifiers and source addresses.
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1133 External Remote ServicesT1021.001 Remote Desktop ProtocolT1003 OS Credential DumpingT1486 Data Encrypted for Impact
- Vendors
- Palo Alto NetworksVeeam
- Products
- PAN-OSGlobalProtect
- Threat actors
- Spikey ScorpiusQilinTarnished Scorpius
- Malware
- Settra
- Organizations
- Unit 42
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2023-27532 | Missing Authentication in Veeam Backup & Replication Exposes Stored Credentials | 7.5 | 81% | KEVRansomware | KEV |
| CVE-2026-0257 | Authentication Bypass in Palo Alto Networks PAN-OS GlobalProtect Portal and Gateway | 7.8 | 97% | KEVRansomware | KEV |
From the original article
2 min read at gbhackers.com
Ransomware operators are exploiting a vulnerability in Palo Alto Networks PAN-OS that allows them to bypass authentication. This issue enables unauthorized VPN sessions, bypasses multifactor authentication (MFA), and allows access to corporate networks. According to Unit 42’s October 19 update, two groups, Spikey Scorpius (also referred to as Qilin) and Tarnished Scorpius, are using CVE-2026-0257.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.