Unit 42 ties Qilin and Inc ransomware to GlobalProtect auth bypass CVE-2026-0257: forged cookies skip MFA, then attackers pivot to vCenter and ESXi.
Palo Alto Networks' Unit 42 updated its threat brief on 19 October to name two ransomware operators, Qilin and Inc, as exploiting CVE-2026-0257, an authentication bypass in the PAN-OS GlobalProtect portal and gateway. The flaw was fixed on 13 May 2026, but firewalls that were not patched, or not reconfigured, have been a way into corporate networks for months. Anyone running GlobalProtect with authentication override cookies enabled is in scope. Panorama and Cloud NGFW are not affected.
What is vulnerable
The bug sits in the authentication override feature, which issues cookies that behave like bearer tokens. The feature is off by default. A firewall is exposed when a GlobalProtect portal or gateway generates or accepts these cookies (portal: Agent Configuration, Authentication tab; gateway: Client Settings, Authentication Override tab) and a specific certificate configuration exists.
Rapid7 explains the mechanism. The condition is reusing the cookie certificate for another feature, such as the HTTPS service of the portal or gateway. An attacker can read that certificate's public key from the TLS chain, forge a cookie with it, and the server trusts the decrypted contents with no signature check. The result is an unauthorized VPN connection that skips MFA. The weakness is CWE-565.
Severity is disputed. Palo Alto scores it 7.8 (High, CVSS 4.0), raised from an initial 4.7 after exploitation was confirmed. NVD's CVSS 3.1 score is 9.1 (Critical). Rapid7 says to treat it as critical.
Who is exploiting it
Rapid7 saw the first exploitation on 17 May, four days after disclosure, with forged cookies used against the local admin account and a second wave on 21 May. In 8 of 10 affected customers the cookies were accepted but no full VPN session formed, and Rapid7 saw no lateral movement. CISA added the flaw to its Known Exploited Vulnerabilities catalog on 29 May with a due date of 1 June, and its feed now marks ransomware use as Known. (Unit 42's page gives 13 May as the KEV date; the CISA feed and NVD both say 29 May, and 13 May is the advisory date.)
Arctic Wolf tied multiple June intrusions to Qilin deployment, with tradecraft ranging from encryption-only to double extortion, which it says may mean several affiliates. Unit 42's October update names Spikey Scorpius (Qilin) and Tarnished Scorpius (Inc). That update came 159 days after the fix and 143 days after the KEV listing.
Once in, Unit 42 describes dual-use RMM tools for reconnaissance, RDP and SMB lateral movement, and staging for credential theft, exfiltration and ransomware. In some cases the actors pivoted from the compromised VPN gateway to a vCenter appliance, disabled ESXi security controls (execInstalledOnly), and used a custom tool to dump domain controller credentials offline from its virtual disk. Some also chained Veeam CVE-2023-27532. Targeted sectors include education, financial services, healthcare, manufacturing, government, and energy and utilities, among others.
ReliaQuest, as relayed by Help Net Security, also links Settra ransomware, and reports Cobalt Strike, BloodHound and SharpHound in related activity. Unit 42 says the Settra link comes from public reporting rather than its own findings, and we could not locate ReliaQuest's primary report, so treat it as unconfirmed.
Exploitation began four days after the fix and ransomware followed in June. Unit 42 named Qilin and Inc 159 days after the patch shipped.
Fixed versions
Upgrade to at least one of the following, or any later release (PAN-OS):
| Branch | Fixed builds |
|---|---|
| 12.1 | 12.1.4-h6, 12.1.7 |
| 11.2 | 11.2.4-h17, 11.2.7-h14, 11.2.10-h7, 11.2.12 |
| 11.1 | 11.1.4-h33, 11.1.6-h32, 11.1.7-h6, 11.1.10-h25, 11.1.13-h5, 11.1.15 |
| 10.2 | 10.2.7-h34, 10.2.10-h36, 10.2.13-h21, 10.2.16-h7, 10.2.18-h6 |
Use the build in your own branch and hotfix train; the advisory maps each installed version to its target. Prisma Access needs 11.2.7-h13 or 10.2.10-h36, and Palo Alto is upgrading it on the schedule shared with customers. Hybrid Prisma Access customers must also upgrade their on-premises firewalls. NVD additionally lists Siemens RUGGEDCOM APE1808 firmware, all versions, as vulnerable with no fixed version.
What defenders should do
- Patch every GlobalProtect portal and gateway that generates or accepts override cookies, internal and external, ideally together. Users must re-authenticate once after the upgrade. In phased, mixed-version rollouts Palo Alto offers a temporary
set global-protect enable-auth-override-cookie-hmac no; set it back toyeswhen all components are upgraded. - If you cannot patch yet, mitigate. Generate a new certificate used only for authentication override cookies, shared with no other feature or user, even if you remove it elsewhere; or disable the generate and accept options.
- End active GlobalProtect sessions after patching. This is ReliaQuest's advice, not Palo Alto's: its warning is that patching does not remove access an attacker already established. The vendor advisory and Rapid7 do not address session termination.
- Hunt back to mid-May. Check successful GlobalProtect logins against the Unit 42 and Rapid7 indicators, including 104.207.144[.]154, 146.19.216[.]119, 146.19.216[.]120 and 146.19.216[.]125 (listed by both), the spoofed MAC aa:bb:cc:dd:ee:ff, and hosts named DESKTOP-GP01, GP-CLIENT or "kali". Unit 42 says to look at activity before 29 May.
- Check the virtualisation tier. Review vCenter and ESXi for changes to execInstalledOnly, and verify Veeam is patched for CVE-2023-27532.
- Check management exposure. Mapping GlobalProtect profiles to HTTP/HTTPS on management interfaces can expose ports 4443 and 3879; restrict them with Interface Management profiles.