Ransomware crews are walking into corporate networks through a Palo Alto Networks VPN flaw that the vendor patched on May 13, 2026. Ransomware groups have widened their targeting of the bug, and Unit 42, the company’s own threat-intelligence arm, named two of them on October 19. The vulnerability is CVE-2026-0257, an authentication bypass in the GlobalProtect portal and gateway of PAN-OS.CVE-2026-0257 Explained: A GlobalProtect Authentication BypassTimeline: A May 13 Patch and an October 19 AttributionHow Qilin and INC Turn a VPN Session Into RansomwareStep one: a VPN foothold that looks normalStep two: the jump to vCenter and ESXiQilin, INC and Settra: Who Is Behind the AttacksWhat Unit 42 and Researchers SayWhy a Patched Bug Still Works Five Months LaterWhich PAN-OS Deployments Are ExposedMarket Impact: Pressure on Palo Alto and the Edge VPN CategoryHow CVE-2026-0257 Compares With Other Edge-Device ExploitsHistorical Context: Edge Devices as the Ransomware Front DoorWhat Defenders Should Do This WeekA short triage checklistFive Predictions for the Next 90 DaysFAQ: CVE-2026-0257 and the GlobalProtect Ransomware AttacksRelated Coverage
The attacks are not new. BleepingComputer reported on July 21 that the Qilin gang was using the bug in intrusions that ended in domain-wide encryption. What changed this month is the paper trail. Unit 42 now tracks Qilin as Spikey Scorpius and INC as Tarnished Scorpius, and it lists both among the operators exploiting the flaw. Public reporting adds a third name, Settra.
Industry insights, the latest tech news, and special interviews, all in the Tech Insider Newsletter.
One email a week. No spam, unsubscribe anytime.
Do not confuse this with CVE-2026-0322, a different PAN-OS flaw that surfaced earlier this month. CVE-2026-0257 is the older bug, and it is the one ransomware operators have been working for roughly five months. This analysis covers what the flaw does, who is using it, why a patched bug keeps paying off, and what security teams should do before the weekend.
Google · Preferred Sources
Don’t miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
CVE-2026-0257 Explained: A GlobalProtect Authentication Bypass
CVE-2026-0257 sits in the GlobalProtect component of PAN-OS, the operating system that runs Palo Alto firewalls. Palo Alto describes the impact in plain terms. An attacker can bypass security restrictions and establish an unauthorized VPN connection. No valid user account is required, and the attacker never has to phish an employee first.
The confirmed affected components are GlobalProtect portals and gateways running vulnerable PAN-OS versions. Reporting also describes Prisma Access, Palo Alto’s cloud-delivered service, as relevant to the issue, though that detail rests on a single report and defenders should confirm their own exposure against the vendor advisory. The company says it became aware of exploit attempts on unpatched devices that lacked mitigations.
You may like
Severity labels have drifted since May. Coverage at disclosure described the flaw as medium severity, and exploitation attempts had already been seen. BleepingComputer’s headline now calls it a critical VPN bug. That gap matters because many teams triage by the rating they saw on patch day and rarely revisit it. A medium label on an internet-facing authentication bypass deserved a faster patch window than the label implied.
CISA added CVE-2026-0257 to its Known Exploited Vulnerabilities catalog on May 13, according to Unit 42. Federal agencies therefore had a mandate to patch from day one. Private companies had no such nudge, and the October attribution suggests plenty of them are still exposed.
Timeline: A May 13 Patch and an October 19 Attribution
The sequence below combines Unit 42’s threat brief with vendor and media reporting. Unit 42 stamped its latest revision on October 19 at 4:00 p.m. PT to add recent ransomware group activity, and the page showed further updates through October 23.
DateEventSourceMay 13, 2026Palo Alto discloses and patches CVE-2026-0257, and CISA adds it to the KEV catalogUnit 42 threat briefMay 29, 2026Date Unit 42 uses to separate pre-proof-of-concept activity from later activityUnit 42 threat briefEarly June 2026Unit 42 begins investigating exploitation across numerous industriesUnit 42 threat briefJune 2026Arctic Wolf investigates multiple intrusions that end in Qilin ransomwareArctic Wolf, via BleepingComputerJuly 21, 2026Public reporting links Qilin to domain-wide encryption through the bugBleepingComputerOctober 9, 2026ReliaQuest reports Qilin and Settra activity creating unauthorized VPN sessionsInfosecurity MagazineOctober 19, 2026Unit 42 names Qilin (Spikey Scorpius) and INC (Tarnished Scorpius)Unit 42 threat briefOctober 20, 2026Brief adds guidance on internet-exposed firewall management interfacesUnit 42 threat briefOctober 23, 2026Unit 42 says it still observes attempted exploitationUnit 42 threat brief
Help Net Security summed up the shape of the story in its headline: ransomware gangs have been exploiting the GlobalProtect flaw since June. The gap between the June intrusions and the October 19 attribution is the real news. Defenders had a patch for five months. Attackers had working intrusions for nearly as long.
How Qilin and INC Turn a VPN Session Into Ransomware
Step one: a VPN foothold that looks normal
The bypass gives an attacker something more valuable than a shell. It gives them a legitimate-looking VPN session. Infosecurity Magazine relayed ReliaQuest’s October 9 finding that Qilin and Settra activity created unauthorized sessions that could resemble ordinary remote-work connections. Security operations teams that watch for odd logins have little to flag when the session arrives through the company’s own gateway.
Once inside, reported activity follows a familiar script. Attackers scan the internal network, move laterally over RDP and SMB, steal credentials, copy data and then deploy ransomware. Cybersecurity Dive reported that the intruders reportedly also used offensive tools such as Cobalt Strike, BloodHound and SharpHound, though that detail comes from public reporting rather than Unit 42’s own brief.
Step two: the jump to vCenter and ESXi
The sharpest tactical shift is the move toward virtualization infrastructure. Reporting from October 22 says Qilin and INC have evolved from simple VPN access to direct attacks on VMware vCenter and ESXi, the layer that hosts an organization’s servers. In at least one case, attackers extracted credentials from a domain controller’s virtual disk, which skips most endpoint defenses entirely.
Encrypting a hypervisor takes down dozens of workloads in one stroke. That is why ransomware gangs prize vCenter access, a pattern also visible when CISA pressed agencies to patch a VMware vCenter bug that ransomware gangs were hitting. A VPN bypass plus a vCenter route gives a crew everything it needs for a rapid, high-impact encryption run.
One caveat deserves space. According to a summary of Unit 42’s brief, only a small share of probed devices established VPN sessions, and Unit 42 had not identified post-access behavior or lateral movement in its own telemetry as of that update. The brief describes attempted exploitation, while outside researchers describe completed intrusions. Both can be true, because Unit 42 sees only its customers and its sensors.
Qilin, INC and Settra: Who Is Behind the Attacks
Attribution here needs care. Unit 42 made two named attributions and flagged a third as public reporting only. Nothing in the sources shows that Qilin and INC are the same organization, and the INC and Tarnished Scorpius pairing is a tracking alias, not a rebrand. Treat each operator separately.
OperatorUnit 42 tracking nameBasis of attributionConfidence noteQilinSpikey ScorpiusUnit 42 update on October 19, plus Arctic Wolf June intrusions and BleepingComputer’s July reportNamed directly by Unit 42INCTarnished ScorpiusUnit 42 update on October 19Named directly by Unit 42, incident details not generalized to every INC operationSettraNot assignedPublic reporting, including ReliaQuest on October 9Palo Alto says it is aware of the reports but has not established Settra as responsible
Arctic Wolf Labs says it assesses with moderate confidence that Qilin intrusions leveraging this bug are likely ongoing. That wording sets a useful bar for readers. Moderate confidence means the evidence points one way without closing every gap, so organizations should assume the threat is live and not wait for a final verdict.
What Unit 42 and Researchers Say
Andy Piazza, senior director of threat intelligence at Unit 42, laid out the attack logic in comments reported by The Register on October 20: “Attackers are leveraging this vulnerability to gain an initial foothold into corporate networks, subsequently bypassing multi-factor authentication (MFA) controls to establish a VPN session.”
The MFA point is the one that should worry security leaders. Many organizations bought MFA to blunt VPN credential theft. A bypass at the gateway makes the second factor irrelevant, because the attacker never reaches the login prompt that would ask for it.
Arctic Wolf Labs, in the report BleepingComputer cited, wrote that it “investigated multiple distinct intrusions during June 2026 that resulted in Qilin ransomware deployment, all originating from exploitation of CVE-2026-0257 against Palo Alto Networks firewall appliances.” The team added that it “assesses with moderate confidence that intrusions leveraging CVE-2026-0257 and leading to Qilin ransomware deployment are likely ongoing.”
Palo Alto’s own words, also relayed by BleepingComputer, describe the technical effect: the flaw in the “GlobalProtect portal and gateway of Palo Alto Networks PAN-OS® software allows the attacker to bypass security restrictions and establish an unauthorized VPN connection.” The vendor also said it had become “aware of limited exploit attempts on unpatched PAN-OS devices without mitigations applied.”
Read together, the quotes tell a consistent story. The vendor patched and warned in May. Responders saw real intrusions by June. The threat-intelligence arm confirmed named ransomware operators in October. The weak link was never the fix itself. It was the distance between a published patch and a patched device.
Why a Patched Bug Still Works Five Months Later
Perimeter appliances are the hardest assets to patch on time. They carry production traffic, they sit in change-freeze calendars, and many teams do not own them cleanly. A firewall that runs the VPN for a whole company needs a maintenance window, a rollback plan and sign-off from three departments. Meanwhile an attacker needs only an unpatched portal and a public exploit path.
You may like
Patch queues are also crowded. Microsoft’s record October Patch Tuesday, with more than 1,400 CVEs, handed Windows admins a mountain of work in the same weeks that Unit 42 updated this brief. Teams forced to triage will favor the largest visible pile, and a May firewall patch fades into the background.
Exposure management has its own blind spot. Scanners that rank findings by a base score will push a medium-rated bug down the list. The original medium label, the narrow configuration condition and the lack of a flashy name all lowered urgency. Buyers comparing platforms such as those in this Tenable, Qualys and Rapid7 breakdown should ask how each tool reprioritizes a finding once the KEV catalog or a threat brief flags active exploitation.
There is a human factor too. Reporting says exposure depends on a specific mix of settings, and many administrators assumed their configuration was safe. A team that cannot quickly answer whether it uses that mix is a team that will guess, and guessing loses against a scripted attacker.
Which PAN-OS Deployments Are Exposed
According to reporting from October 2026, exposure requires two conditions. Authentication-override cookies must be enabled, and the certificate used for those cookies must also serve a public-facing service. If either condition fails, the exposure described by researchers does not apply. That helps defenders scope the risk, but it should not lull them into skipping the patch.
Palo Alto’s temporary mitigations followed from that logic. Administrators could disable authentication-override cookies or generate a certificate that serves only those cookies. Both steps are configuration changes that do not need a firmware upgrade, which makes them useful stopgaps while a maintenance window gets scheduled.
The permanent fix is the patched PAN-OS release that matches each deployed branch. This article does not list fixed version numbers because the vendor advisory is the authoritative source and branches differ. Check the advisory for your exact release, then confirm the installed version on the device itself.
Unit 42 also separates its guidance by period. Its brief tells readers to search GlobalProtect logs for listed IP addresses to find successful logins, with the May 29, 2026 proof-of-concept date marking the split between earlier and later activity. Teams that only started looking after October 19 may need to search logs back to early June.
Market Impact: Pressure on Palo Alto and the Edge VPN Category
Palo Alto responded the way large vendors usually do. It published fixes, updated protection coverage (the brief notes XDR and XSIAM coverage added on June 9) and kept the threat brief current. No product or price change tied to the flaw has surfaced, and nothing in the sources points to a recall or a rename. The reputational cost is real but bounded, because the vendor disclosed and patched the flaw before exploitation reached ransomware scale.
The larger market effect lands on the architecture. Unit 42’s 2026 Global Incident Response Report says identity-based techniques drive 65% of initial access, and 87% of attacks unfold across multiple attack surfaces. A VPN bypass that defeats MFA fits that pattern neatly. Boards that read those numbers will ask why the company still publishes a VPN portal to the open internet.
That question favors cloud-delivered access models. Buyers can weigh them using this Zscaler, Palo Alto and Cloudflare comparison, which sets the platforms side by side. Note the irony, though. Prisma Access is Palo Alto’s own cloud service and reporting names it as relevant here, so moving to the cloud does not erase the need to verify what the vendor runs for you.
Read nextJapan Ransomware Hits Record High: 123 Cases in H1 [2026]Cybersecurity · Sep 10
Cyber insurers are another pressure point. A ransomware loss that starts with a known, patched, KEV-listed flaw is the kind of claim underwriters question hardest. Expect renewal questionnaires to ask directly whether internet-facing VPN appliances were patched within the vendor’s window.
How CVE-2026-0257 Compares With Other Edge-Device Exploits
Palo Alto is not the only vendor in this position. Fortinet, Check Point, Citrix and others ship internet-facing gateways that attackers probe constantly. Shoppers weighing those vendors can start with this Palo Alto, Fortinet and Check Point cost comparison, then add a plain question to every vendor call: how fast does the vendor publish, and how fast do customers apply?
The pattern across vendors is the same. A flaw gets patched, researchers publish technical detail, a proof of concept appears, and criminals fold it into their toolkits. The Citrix case is a close cousin, since a NetScaler bug that landed on the KEV list also left a large pool of exposed appliances for attackers to harvest.
What sets CVE-2026-0257 apart is the combination of an authentication bypass and a quiet start. A remote code execution flaw announces itself with crashes and shells. A bypass that yields a clean VPN session leaves fewer fingerprints, so the first sign is often an encrypted file server and not an alert.
Historical Context: Edge Devices as the Ransomware Front Door
Ransomware groups have favored VPN and firewall appliances as entry points for years. The economics explain why. An appliance exposes one reliable interface to the internet, sits outside most endpoint agents and often holds the keys to the internal network. One working exploit scales across thousands of targets, while a phishing campaign must win each victim one at a time.
Development tooling shows the same dynamic. When a JetBrains TeamCity flaw drew ransomware exploitation, defenders saw the same sequence of patch, proof of concept and crime. Different product, same lifecycle.
What has changed is speed and specialization. Criminal crews now split the work. Initial-access brokers and affiliates find and use the foothold, and a ransomware program supplies the encryptor and the leak site. That division of labor helps explain why more than one operator appeared on a single flaw, and why Unit 42 had to track several groups under different aliases.
What Defenders Should Do This Week
A short triage checklist
Start with inventory. Many teams discover during an incident that a forgotten gateway still runs an old release. The table below ranks the work by urgency, and the order reflects the attack path described in the reporting.
PriorityActionWhy it matters1List every GlobalProtect portal and gateway, including cloud and branch instancesThe bug lives in those components, and forgotten gateways stay unpatched2Install the fixed PAN-OS release for each branch, per the vendor advisoryThe patch has existed since May 13, 20263If patching must wait, disable authentication-override cookies or give them a dedicated certificateBreaks the exposure condition described in reporting4Review GlobalProtect login and connection logs back to early June 2026Unit 42 has investigated exploitation since early June5Hunt for lateral movement over RDP and SMB, and for new accounts or toolsReported attack chains use both before encryption6Lock down vCenter and ESXi access and back up domain controllers offlineReported pivots target virtualization and domain controller disks7Remove firewall management interfaces from the public internetUnit 42 added this guidance on October 20
To confirm the running release on a PAN-OS device, an administrator can read it from the command line and compare it with the advisory’s fixed versions.
show system info | match sw-version
If logs show sessions from the indicator addresses in Unit 42’s brief, treat the environment as breached and start incident response. Rotate credentials for every account that touched the VPN, reset service accounts and review domain controller access. For broader context on how defenders organize this work, the cybersecurity coverage hub collects related incident write-ups.
Five Predictions for the Next 90 Days
These are analysis and judgment, not reported facts.
More named operators will join the list. A public proof of concept and months of working intrusions invite copycats. Settra is the first extra name, and it will not be the last.Virtualization attacks will dominate the next advisories. The move from VPN to vCenter and ESXi gives crews the fastest route to maximum damage, so expect follow-up guidance focused on the hypervisor layer.Insurers will tighten edge-device questions. Applications will ask about patch timing for internet-facing appliances, and weak answers will raise premiums or trim coverage.Vendors will ship tougher defaults. Cookie and certificate settings that enabled this exposure are prime candidates for safer defaults or louder configuration warnings.Zero-trust access projects will accelerate. Security leaders who already wanted fewer public VPN portals now have an incident to cite when asking for budget.
FAQ: CVE-2026-0257 and the GlobalProtect Ransomware Attacks
What is CVE-2026-0257? It is an authentication-bypass vulnerability in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS. An unauthenticated attacker can bypass security restrictions and establish an unauthorized VPN connection.
Has Palo Alto released a fix? Yes. Palo Alto disclosed and patched the flaw on May 13, 2026. Administrators should install the fixed release for their branch as listed in the vendor advisory.
Which ransomware groups are exploiting it? Unit 42 names Qilin, tracked as Spikey Scorpius, and INC, tracked as Tarnished Scorpius. Public reporting also attributes activity to Settra, but Palo Alto has not confirmed that attribution.
Does the flaw bypass multi-factor authentication? According to Unit 42’s Andy Piazza, attackers use the flaw to gain a foothold and then bypass MFA controls to establish a VPN session. The bypass happens at the gateway, so the second factor never comes into play.
Who is at risk? Organizations running vulnerable PAN-OS versions with GlobalProtect portals or gateways. Reporting says exposure requires authentication-override cookies to be enabled and the cookie certificate to be used for a public-facing service.
What can I do if I cannot patch right away? Disable authentication-override cookies or generate a certificate used only for them. These were the temporary mitigations reported at disclosure. Then schedule the upgrade, review logs back to early June and take management interfaces off the public internet.
Is this the same as CVE-2026-0322? No. CVE-2026-0322 is a separate PAN-OS flaw. CVE-2026-0257 was patched in May and is the one tied to the Qilin and INC attacks in Unit 42’s October update.
How do I know if I was breached? Search GlobalProtect logs for the indicator IP addresses in Unit 42’s threat brief and look for unusual RDP or SMB movement, new accounts and access to vCenter. If anything matches, start incident response and rotate credentials.
More on this topicCybersecurityCloud ComputingSoftwareAI & Machine LearningTrending noweMudhra’s CA Keys Cracked: One Was the Number 4 [2026]SBI Data Leak: 3,897 Records Hit Dark Web [2026]CoinDCX Denies $16M Hack as Sleuths Dispute Story [2026]Ocarina of Time Switch 2 Pre-Orders Cut $10 [2026]Switch 2 Black Friday Deals Hit Early at $549 [2026]
Elias VirtanenCybersecurity AnalystElias Virtanen is the Cybersecurity Analyst at Tech Insider, bringing hands-on expertise from his background in penetration testing and security consulting. He previously worked as a security researcher at F-Secure in Helsinki, where he focused on threat intelligence and vulnerability disclosure. Elias covers ransomware trends, zero-trust architecture, and the evolving regulatory landscape including NIS2 and the EU Cyber Resilience Act. He holds a CISSP certification and an MSc in Information Security from Aalto University.View all articles
The Tech Insider Newsletter
Industry insights, the latest tech news, and special interviews, every week.
One email a week. No spam, unsubscribe anytime.
Click Here For The Original Source.
——————————————————–
