Ransomware crews are walking into corporate networks through a Palo Alto Networks VPN flaw that the vendor patched on May 13, 2026. Ransomware groups have widened their targeting of the bug, and Unit 42, the company’s own threat-intelligence arm, named two of them on October 19. The vulnerability is CVE-2026-0257, an authentication bypass in the GlobalProtect portal and gateway of PAN-OS.
The attacks are not new. BleepingComputer reported on July 21 that the Qilin gang was using the bug in intrusions that ended in domain-wide encryption. What changed this month is the paper trail. Unit 42 now tracks Qilin as Spikey Scorpius and INC as Tarnished Scorpius, and it lists both among the operators exploiting the flaw. Public reporting adds a third name, Settra.
Do not confuse this with CVE-2026-0322, a different PAN-OS flaw that surfaced earlier this month. CVE-2026-0257 is the older bug, and it is the one ransomware operators have been working for roughly five months. This analysis covers what the flaw does, who is using it, why a patched bug keeps paying off, and what security teams should do before the weekend.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
CVE-2026-0257 Explained: A GlobalProtect Authentication Bypass
CVE-2026-0257 sits in the GlobalProtect component of PAN-OS, the operating system that runs Palo Alto firewalls. Palo Alto describes the impact in plain terms. An attacker can bypass security restrictions and establish an unauthorized VPN connection. No valid user account is required, and the attacker never has to phish an employee first.
The confirmed affected components are GlobalProtect portals and gateways running vulnerable PAN-OS versions. Reporting also describes Prisma Access, Palo Alto’s cloud-delivered service, as relevant to the issue, though that detail rests on a single report and defenders should confirm their own exposure against the vendor advisory. The company says it became aware of exploit attempts on unpatched devices that lacked mitigations.
Severity labels have drifted since May. Coverage at disclosure described the flaw as medium severity, and exploitation attempts had already been seen. BleepingComputer’s headline now calls it a critical VPN bug. That gap matters because many teams triage by the rating they saw on patch day and rarely revisit it. A medium label on an internet-facing authentication bypass deserved a faster patch window than the label implied.
CISA added CVE-2026-0257 to its Known Exploited Vulnerabilities catalog on May 13, according to Unit 42. Federal agencies therefore had a mandate to patch from day one. Private companies had no such nudge, and the October attribution suggests plenty of them are still exposed.
Timeline: A May 13 Patch and an October 19 Attribution
The sequence below combines Unit 42’s threat brief with vendor and media reporting. Unit 42 stamped its latest revision on October 19 at 4:00 p.m. PT to add recent ransomware group activity, and the page showed further updates through October 23.
| Date | Event | Source |
|---|---|---|
| May 13, 2026 | Palo Alto discloses and patches CVE-2026-0257, and CISA adds it to the KEV catalog | Unit 42 threat brief |
| May 29, 2026 | Date Unit 42 uses to separate pre-proof-of-concept activity from later activity | Unit 42 threat brief |
| Early June 2026 | Unit 42 begins investigating exploitation across numerous industries | Unit 42 threat brief |
| June 2026 | Arctic Wolf investigates multiple intrusions that end in Qilin ransomware | Arctic Wolf, via BleepingComputer |
| July 21, 2026 | Public reporting links Qilin to domain-wide encryption through the bug | BleepingComputer |
| October 9, 2026 | ReliaQuest reports Qilin and Settra activity creating unauthorized VPN sessions | Infosecurity Magazine |
| October 19, 2026 | Unit 42 names Qilin (Spikey Scorpius) and INC (Tarnished Scorpius) | Unit 42 threat brief |
| October 20, 2026 | Brief adds guidance on internet-exposed firewall management interfaces | Unit 42 threat brief |
| October 23, 2026 | Unit 42 says it still observes attempted exploitation | Unit 42 threat brief |
Help Net Security summed up the shape of the story in its headline: ransomware gangs have been exploiting the GlobalProtect flaw since June. The gap between the June intrusions and the October 19 attribution is the real news. Defenders had a patch for five months. Attackers had working intrusions for nearly as long.
How Qilin and INC Turn a VPN Session Into Ransomware
Step one: a VPN foothold that looks normal
The bypass gives an attacker something more valuable than a shell. It gives them a legitimate-looking VPN session. Infosecurity Magazine relayed ReliaQuest’s October 9 finding that Qilin and Settra activity created unauthorized sessions that could resemble ordinary remote-work connections. Security operations teams that watch for odd logins have little to flag when the session arrives through the company’s own gateway.
Once inside, reported activity follows a familiar script. Attackers scan the internal network, move laterally over RDP and SMB, steal credentials, copy data and then deploy ransomware. Cybersecurity Dive reported that the intruders reportedly also used offensive tools such as Cobalt Strike, BloodHound and SharpHound, though that detail comes from public reporting rather than Unit 42’s own brief.
Step two: the jump to vCenter and ESXi
The sharpest tactical shift is the move toward virtualization infrastructure. Reporting from October 22 says Qilin and INC have evolved from simple VPN access to direct attacks on VMware vCenter and ESXi, the layer that hosts an organization’s servers. In at least one case, attackers extracted credentials from a domain controller’s virtual disk, which skips most endpoint defenses entirely.
Encrypting a hypervisor takes down dozens of workloads in one stroke. That is why ransomware gangs prize vCenter access, a pattern also visible when CISA pressed agencies to patch a VMware vCenter bug that ransomware gangs were hitting. A VPN bypass plus a vCenter route gives a crew everything it needs for a rapid, high-impact encryption run.
One caveat deserves space. According to a summary of Unit 42’s brief, only a small share of probed devices established VPN sessions, and Unit 42 had not identified post-access behavior or lateral movement in its own telemetry as of that update. The brief describes attempted exploitation, while outside researchers describe completed intrusions. Both can be true, because Unit 42 sees only its customers and its sensors.
Qilin, INC and Settra: Who Is Behind the Attacks
Attribution here needs care. Unit 42 made two named attributions and flagged a third as public reporting only. Nothing in the sources shows that Qilin and INC are the same organization, and the INC and Tarnished Scorpius pairing is a tracking alias, not a rebrand. Treat each operator separately.
| Operator | Unit 42 tracking name | Basis of attribution | Confidence note |
|---|---|---|---|
| Qilin | Spikey Scorpius | Unit 42 update on October 19, plus Arctic Wolf June intrusions and BleepingComputer’s July report | Named directly by Unit 42 |
| INC | Tarnished Scorpius | Unit 42 update on October 19 | Named directly by Unit 42, incident details not generalized to every INC operation |
| Settra | Not assigned | Public reporting, including ReliaQuest on October 9 | Palo Alto says it is aware of the reports but has not established Settra as responsible |
Arctic Wolf Labs says it assesses with moderate confidence that Qilin intrusions leveraging this bug are likely ongoing. That wording sets a useful bar for readers. Moderate confidence means the evidence points one way without closing every gap, so organizations should assume the threat is live and not wait for a final verdict.
What Unit 42 and Researchers Say
Andy Piazza, senior director of threat intelligence at Unit 42, laid out the attack logic in comments reported by The Register on October 20: “Attackers are leveraging this vulnerability to gain an initial foothold into corporate networks, subsequently bypassing multi-factor authentication (MFA) controls to establish a VPN session.”
The MFA point is the one that should worry security leaders. Many organizations bought MFA to blunt VPN credential theft. A bypass at the gateway makes the second factor irrelevant, because the attacker never reaches the login prompt that would ask for it.
Arctic Wolf Labs, in the report BleepingComputer cited, wrote that it “investigated multiple distinct intrusions during June 2026 that resulted in Qilin ransomware deployment, all originating from exploitation of CVE-2026-0257 against Palo Alto Networks firewall appliances.” The team added that it “assesses with moderate confidence that intrusions leveraging CVE-2026-0257 and leading to Qilin ransomware deployment are likely ongoing.”
Palo Alto’s own words, also relayed by BleepingComputer, describe the technical effect: the flaw in the “GlobalProtect portal and gateway of Palo Alto Networks PAN-OS® software allows the attacker to bypass security restrictions and establish an unauthorized VPN connection.” The vendor also said it had become “aware of limited exploit attempts on unpatched PAN-OS devices without mitigations applied.”
Read together, the quotes tell a consistent story. The vendor patched and warned in May. Responders saw real intrusions by June. The threat-intelligence arm confirmed named ransomware operators in October. The weak link was never the fix itself. It was the distance between a published patch and a patched device.
Why a Patched Bug Still Works Five Months Later
Perimeter appliances are the hardest assets to patch on time. They carry production traffic, they sit in change-freeze calendars, and many teams do not own them cleanly. A firewall that runs the VPN for a whole company needs a maintenance window, a rollback plan and sign-off from three departments. Meanwhile an attacker needs only an unpatched portal and a public exploit path.
Patch queues are also crowded. Microsoft’s record October Patch Tuesday, with more than 1,400 CVEs, handed Windows admins a mountain of work in the same weeks that Unit 42 updated this brief. Teams forced to triage will favor the largest visible pile, and a May firewall patch fades into the background.
Exposure management has its own blind spot. Scanners that rank findings by a base score will push a medium-rated bug down the list. The original medium label, the narrow configuration condition and the lack of a flashy name all lowered urgency. Buyers comparing platforms such as those in this Tenable, Qualys and Rapid7 breakdown should ask how each tool reprioritizes a finding once the KEV catalog or a threat brief flags active exploitation.
There is a human factor too. Reporting says exposure depends on a specific mix of settings, and many administrators assumed their configuration was safe. A team that cannot quickly answer whether it uses that mix is a team that will guess, and guessing loses against a scripted attacker.
Which PAN-OS Deployments Are Exposed
According to reporting from October 2026, exposure requires two conditions. Authentication-override cookies must be enabled, and the certificate used for those cookies must also serve a public-facing service. If either condition fails, the exposure described by researchers does not apply. That helps defenders scope the risk, but it should not lull them into skipping the patch.
Palo Alto’s temporary mitigations followed from that logic. Administrators could disable authentication-override cookies or generate a certificate that serves only those cookies. Both steps are configuration changes that do not need a firmware upgrade, which makes them useful stopgaps while a maintenance window gets scheduled.
The permanent fix is the patched PAN-OS release that matches each deployed branch. This article does not list fixed version numbers because the vendor advisory is the authoritative source and branches differ. Check the advisory for your exact release, then confirm the installed version on the device itself.
Unit 42 also separates its guidance by period. Its brief tells readers to search GlobalProtect logs for listed IP addresses to find successful logins, with the May 29, 2026 proof-of-concept date marking the split between earlier and later activity. Teams that only started looking after October 19 may need to search logs back to early June.
Market Impact: Pressure on Palo Alto and the Edge VPN Category
Palo Alto responded the way large vendors usually do. It published fixes, updated protection coverage (the brief notes XDR and XSIAM coverage added on June 9) and kept the threat brief current. No product or price change tied to the flaw has surfaced, and nothing in the sources points to a recall or a rename. The reputational cost is real but bounded, because the vendor disclosed and patched the flaw before exploitation reached ransomware scale.
The larger market effect lands on the architecture. Unit 42’s 2026 Global Incident Response Report says identity-based techniques drive 65% of initial access, and 87% of attacks unfold across multiple attack surfaces. A VPN bypass that defeats MFA fits that pattern neatly. Boards that read those numbers will ask why the company still publishes a VPN portal to the open internet.
That question favors cloud-delivered access models. Buyers can weigh them using this Zscaler, Palo Alto and Cloudflare comparison, which sets the platforms side by side. Note the irony, though. Prisma Access is Palo Alto’s own cloud service and reporting names it as relevant here, so moving to the cloud does not erase the need to verify what the vendor runs for you.
Cyber insurers are another pressure point. A ransomware loss that starts with a known, patched, KEV-listed flaw is the kind of claim underwriters question hardest. Expect renewal questionnaires to ask directly whether internet-facing VPN appliances were patched within the vendor’s window.
How CVE-2026-0257 Compares With Other Edge-Device Exploits
Palo Alto is not the only vendor in this position. Fortinet, Check Point, Citrix and others ship internet-facing gateways that attackers probe constantly. Shoppers weighing those vendors can start with this Palo Alto, Fortinet and Check Point cost comparison, then add a plain question to every vendor call: how fast does the vendor publish, and how fast do customers apply?
The pattern across vendors is the same. A flaw gets patched, researchers publish technical detail, a proof of concept appears, and criminals fold it into their toolkits. The Citrix case is a close cousin, since a NetScaler bug that landed on the KEV list also left a large pool of exposed appliances for attackers to harvest.
What sets CVE-2026-0257 apart is the combination of an authentication bypass and a quiet start. A remote code execution flaw announces itself with crashes and shells. A bypass that yields a clean VPN session leaves fewer fingerprints, so the first sign is often an encrypted file server and not an alert.
Historical Context: Edge Devices as the Ransomware Front Door
Ransomware groups have favored VPN and firewall appliances as entry points for years. The economics explain why. An appliance exposes one reliable interface to the internet, sits outside most endpoint agents and often holds the keys to the internal network. One working exploit scales across thousands of targets, while a phishing campaign must win each victim one at a time.
Development tooling shows the same dynamic. When a JetBrains TeamCity flaw drew ransomware exploitation, defenders saw the same sequence of patch, proof of concept and crime. Different product, same lifecycle.
What has changed is speed and specialization. Criminal crews now split the work. Initial-access brokers and affiliates find and use the foothold, and a ransomware program supplies the encryptor and the leak site. That division of labor helps explain why more than one operator appeared on a single flaw, and why Unit 42 had to track several groups under different aliases.
What Defenders Should Do This Week
A short triage checklist
Start with inventory. Many teams discover during an incident that a forgotten gateway still runs an old release. The table below ranks the work by urgency, and the order reflects the attack path described in the reporting.
| Priority | Action | Why it matters |
|---|---|---|
| 1 | List every GlobalProtect portal and gateway, including cloud and branch instances | The bug lives in those components, and forgotten gateways stay unpatched |
| 2 | Install the fixed PAN-OS release for each branch, per the vendor advisory | The patch has existed since May 13, 2026 |
| 3 | If patching must wait, disable authentication-override cookies or give them a dedicated certificate | Breaks the exposure condition described in reporting |
| 4 | Review GlobalProtect login and connection logs back to early June 2026 | Unit 42 has investigated exploitation since early June |
| 5 | Hunt for lateral movement over RDP and SMB, and for new accounts or tools | Reported attack chains use both before encryption |
| 6 | Lock down vCenter and ESXi access and back up domain controllers offline | Reported pivots target virtualization and domain controller disks |
| 7 | Remove firewall management interfaces from the public internet | Unit 42 added this guidance on October 20 |
To confirm the running release on a PAN-OS device, an administrator can read it from the command line and compare it with the advisory’s fixed versions.
show system info | match sw-versionIf logs show sessions from the indicator addresses in Unit 42’s brief, treat the environment as breached and start incident response. Rotate credentials for every account that touched the VPN, reset service accounts and review domain controller access. For broader context on how defenders organize this work, the cybersecurity coverage hub collects related incident write-ups.
Five Predictions for the Next 90 Days
These are analysis and judgment, not reported facts.
- More named operators will join the list. A public proof of concept and months of working intrusions invite copycats. Settra is the first extra name, and it will not be the last.
- Virtualization attacks will dominate the next advisories. The move from VPN to vCenter and ESXi gives crews the fastest route to maximum damage, so expect follow-up guidance focused on the hypervisor layer.
- Insurers will tighten edge-device questions. Applications will ask about patch timing for internet-facing appliances, and weak answers will raise premiums or trim coverage.
- Vendors will ship tougher defaults. Cookie and certificate settings that enabled this exposure are prime candidates for safer defaults or louder configuration warnings.
- Zero-trust access projects will accelerate. Security leaders who already wanted fewer public VPN portals now have an incident to cite when asking for budget.
FAQ: CVE-2026-0257 and the GlobalProtect Ransomware Attacks
What is CVE-2026-0257? It is an authentication-bypass vulnerability in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS. An unauthenticated attacker can bypass security restrictions and establish an unauthorized VPN connection.
Has Palo Alto released a fix? Yes. Palo Alto disclosed and patched the flaw on May 13, 2026. Administrators should install the fixed release for their branch as listed in the vendor advisory.
Which ransomware groups are exploiting it? Unit 42 names Qilin, tracked as Spikey Scorpius, and INC, tracked as Tarnished Scorpius. Public reporting also attributes activity to Settra, but Palo Alto has not confirmed that attribution.
Does the flaw bypass multi-factor authentication? According to Unit 42’s Andy Piazza, attackers use the flaw to gain a foothold and then bypass MFA controls to establish a VPN session. The bypass happens at the gateway, so the second factor never comes into play.
Who is at risk? Organizations running vulnerable PAN-OS versions with GlobalProtect portals or gateways. Reporting says exposure requires authentication-override cookies to be enabled and the cookie certificate to be used for a public-facing service.
What can I do if I cannot patch right away? Disable authentication-override cookies or generate a certificate used only for them. These were the temporary mitigations reported at disclosure. Then schedule the upgrade, review logs back to early June and take management interfaces off the public internet.
Is this the same as CVE-2026-0322? No. CVE-2026-0322 is a separate PAN-OS flaw. CVE-2026-0257 was patched in May and is the one tied to the Qilin and INC attacks in Unit 42’s October update.
How do I know if I was breached? Search GlobalProtect logs for the indicator IP addresses in Unit 42’s threat brief and look for unusual RDP or SMB movement, new accounts and access to vCenter. If anything matches, start incident response and rotate credentials.
