Ransomware groups exploit GlobalProtect MFA bypass CVE-2026-0257
Original title: Hackers Exploit Palo Alto VPN Flaw to Bypass MFA and Steal Credentials From VMware Disks
Unit 42 says attackers forged authentication-override cookies, then pulled domain credentials from a VMware virtual disk offline.
Palo Alto Networks Unit 42 says ransomware operators are exploiting CVE-2026-0257 in GlobalProtect portals and gateways to bypass login and MFA when authentication-override cookies and a vulnerable certificate setup are enabled. Researchers link the activity to Qilin (Spikey Scorpius) and Inc (Tarnished Scorpius); separate reporting ties it to Settra. In one case since early June, attackers reached vCenter, disabled execInstalledOnly on ESXi, and extracted domain-controller credentials from a VMDK, and some also used Veeam flaw CVE-2023-27532. Palo Alto rates the VPN flaw High (CVSS 7.8); Panorama and Cloud NGFW are not affected.
Unconfirmed: The Settra link comes from separate public reporting, and Unit 42 did not name the custom VMDK extraction tool.
- Exposure needs authentication-override cookies plus a reused cookie certificate.
- Sectors named include healthcare, education, finance, manufacturing, government, and energy.
- Attackers moved with RDP and SMB after the VPN session.
- Indicators include 104.207.144[.]154, 146.19.216[.]125, GP-CLIENT, and DESKTOP-GP01.
- Temporary fixes: disable override cookies or issue a cookie-only certificate.
Impact: VPN access without MFA, then credential and data theft and ransomware
| Product | Affected |
|---|---|
| Palo Alto Networks GlobalProtect | Certain PAN-OS and Prisma Access deployments with authentication override cookies enabled |
| Veeam backup infrastructure | — |
- 1.Upgrade every affected GlobalProtect portal and gateway per the Palo Alto advisory.
- 2.Disable authentication override or generate a certificate used only for override cookies.
- 3.Check GlobalProtect logs for the reported IPs, device names GP-CLIENT and DESKTOP-GP01, and listed host IDs.
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1133 External Remote ServicesT1021.001 Remote Desktop ProtocolT1021.002 SMB/Windows Admin SharesT1003 OS Credential Dumping
- Organizations
- Unit 42
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2023-27532 | Missing Authentication in Veeam Backup & Replication Exposes Stored Credentials | 7.5 | 81% | KEVRansomware | KEV |
| CVE-2026-0257 | Authentication Bypass in Palo Alto Networks PAN-OS GlobalProtect Portal and Gateway | 7.8 | 97% | KEVRansomware | KEV |
From the original article
3 min read at cybersecuritynews.com
Ransomware operators are exploiting a Palo Alto Networks GlobalProtect VPN flaw to bypass multi-factor authentication and enter corporate networks. In one investigated case, attackers reached VMware management systems and stole credentials directly from a domain controller’s virtual disk, avoiding security tools running inside the virtual machine. Palo Alto Networks Unit 42 detailed the activity in […]
By Guru Baran · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.