Qilin and Inc ransomware are exploiting Palo Alto PAN-OS flaw CVE-2026-0257 to bypass VPN login

Ransomware crews including Qilin and Inc have been breaking into corporate networks through CVE-2026-0257, an authentication bypass in the GlobalProtect VPN feature of Palo Alto Networks' PAN-OS firewall software, and Palo Alto's own incident-response unit says it has been investigating those attacks since early June 2026. The flaw was patched on 13 May, so the attacks hit organisations that never applied the fix or the workaround. On 19 and 20 October, Unit 42 updated its threat brief with the ransomware activity and new guidance, including a pivot into virtualisation infrastructure that bypasses endpoint security tools.

Key points

• CVE-2026-0257 is an authentication bypass in the PAN-OS GlobalProtect portal and gateway that lets an attacker establish an unauthorised VPN connection; Palo Alto rates it high severity, CVSS 4.0 score 7.8, and published patches on 13 May 2026 (Palo Alto advisory).
• It only affects portals and gateways that use authentication override cookies together with a particular certificate configuration; Panorama and Cloud NGFW are not affected (Palo Alto advisory).
• Unit 42 ties the exploitation to the Qilin ("Spikey Scorpius") and Inc ("Tarnished Scorpius") ransomware groups, and says public reporting also links the Settra ransomware operators (Unit 42).
• Arctic Wolf investigated several June 2026 intrusions in which attackers entered through the flaw and deployed Qilin ransomware (Arctic Wolf).
• Upgrading regenerates the override cookies, so GlobalProtect users must sign in again once; Arctic Wolf also advises ending active GlobalProtect sessions after patching.

What happened

Palo Alto Networks disclosed and fixed the bug on 13 May 2026. The advisory describes it as an authentication bypass in the GlobalProtect portal and gateway that lets an attacker "bypass security restrictions and establish an unauthorized VPN connection". The company said it was aware of limited exploit attempts against unpatched devices without mitigations. According to The Register, the vendor first rated it medium severity; the current advisory shows high, and its FAQ explains that the displayed severity reflects the threat score, which rises when public proof-of-concept code or real attacks appear, while the base score is unchanged.

The Register also reports that Rapid7 researchers saw successful exploitation across several customer environments by the end of May, going back to at least 17 May. Unit 42's first brief described an unidentified actor targeting GlobalProtect, with only a small share of probed devices ending up with a VPN session and no post-access activity seen at that point.

The latest update, dated 19 October, adds the ransomware picture. Unit 42 names Spikey Scorpius (its name for Qilin) and Tarnished Scorpius (Inc) and says public reporting also ties exploitation to Settra. The Register quotes Andy Piazza, a senior director of threat intelligence at Unit 42: "Attackers are leveraging this vulnerability to gain an initial foothold into corporate networks, subsequently bypassing multi-factor authentication (MFA) controls to establish a VPN session."

How the attacks work

The sequence Unit 42 describes, and which Arctic Wolf's June incident reports match in detail, runs like this:

1. Entry. The attacker abuses the cookie-based authentication override on an exposed GlobalProtect portal or gateway and gets a VPN session without passing the normal login, including multi-factor checks. Arctic Wolf saw sessions from systems with the hostname "kali".
2. Foothold and reconnaissance. Remote-management tools such as AnyDesk, Ngrok and MeshAgent are installed, and network scanners are run.
3. Credential theft. Arctic Wolf saw LSASS memory dumped through rundll32 and comsvcs.dll, and the Active Directory database copied with ntdsutil.
4. Lateral movement. RDP and SMB, including PsExec over administrative shares.
5. Data theft in some cases. Rclone, ProtonDrive and FileZilla, mainly to MEGA, and attempts against Veeam backup systems. Unit 42 says criminals have chained the entry with a Veeam flaw, CVE-2023-27532.
6. Ransomware. Arctic Wolf saw Qilin staged as win.exe in the C:\PerfLogs folder; event logs were cleared and Microsoft Defender was disabled in some intrusions.

Dwell time varied. Arctic Wolf says some intrusions reached enterprise-wide encryption with minimal dwell time, while others involved long reconnaissance. It does not give an exact count of incidents, only that there were multiple.

The virtualisation pivot

What Unit 42 calls the most significant change is a direct move onto the virtualisation layer. In one case the attackers went from the compromised VPN gateway to a vCenter management appliance, disabled the execInstalledOnly protection on ESXi hosts, and used a custom tool to dump credentials offline from a domain controller's virtual disk (VMDK). Because that reads the disk from outside the guest operating system, it sidesteps endpoint detection and response software running inside the virtual machine. Unit 42 described it, in The Register's report, as a highly sophisticated way to steal domain-wide credentials.

Who is affected

Unit 42 lists victims across education, financial services, healthcare, high tech, hospitality, manufacturing, professional and legal services, government, transportation and logistics, utilities and energy, and wholesale and retail. Palo Alto did not tell The Register how many organisations have been hit. The advisory says only firewalls with the specific GlobalProtect cookie configuration are exposed, so many PAN-OS users are not at risk from this bug.

Palo Alto's advisory lists fixed releases for each supported branch: 12.1.4-h6 and 12.1.7; 11.2.4-h17, 11.2.7-h14, 11.2.10-h7 and 11.2.12; 11.1.4-h33, 11.1.6-h32, 11.1.7-h6, 11.1.10-h25, 11.1.13-h5 and 11.1.15; and 10.2.7-h34, 10.2.10-h36, 10.2.13-h21, 10.2.16-h7 and 10.2.18-h6. Prisma Access is upgraded by Palo Alto on its own schedule (11.2.7-h13 and 10.2.10-h36). Older unsupported PAN-OS versions need an upgrade to a supported fixed release.

Background

GlobalProtect is the VPN and remote-access component of PAN-OS, and internet-facing VPN gateways are a favourite starting point for ransomware because one weak login gives access to the internal network. This bug is a case in point: the cookie that is meant to let a returning user skip re-authentication became the way in. The advisory classifies the weakness as CWE-565, reliance on cookies without validation and integrity checking.

The timeline from the sources: patch on 13 May; the advisory's exploitation status updated on 29 May; Rapid7 sees exploitation from at least 17 May (The Register); Arctic Wolf investigates ransomware incidents in June and publishes on 20 July; Unit 42 adds the ransomware attribution on 19 October. Reports differ on when CISA added the bug to its Known Exploited Vulnerabilities catalog (the current Unit 42 brief says 13 May, while other coverage gives 29 May or early June). We could not verify the date against CISA's catalog, so we do not give one.

What to do

Palo Alto's advisory gives two options besides upgrading. Use a dedicated certificate exclusively for authentication override cookies, not shared with the portal, gateway or other features, or turn off the override options for generating and accepting cookies. Upgrade all portals and gateways that generate or accept cookies together to avoid compatibility problems. For phased upgrades, a CLI setting (set global-protect enable-auth-override-cookie-hmac no) temporarily reverts to the legacy cookie behaviour and should be set back to yes once everything is fixed.

Unit 42 added guidance on 20 October about management-interface exposure: some organisations had mapped GlobalProtect profiles to HTTP/HTTPS services on management interfaces, exposing ports 4443 and 3879 to the internet. It says to test an out-of-band HTTPS connection to the management IP on those ports and to restrict access with Interface Management profiles. It also lists indicators of compromise, including nine IP addresses, and suggests searching GlobalProtect logs for hard-coded client values such as "Windows 10 Pro" with an empty domain and for suspicious host names.

Arctic Wolf recommends terminating active GlobalProtect sessions after patching; rotating domain admin, service-account and cloud-storage credentials if exploitation is suspected, and resetting the KRBTGT account twice; watching C:\PerfLogs\ for executables; alerting on writes to C$ shares, PSEXESVC.exe creation and bursts of Logon Type 3 activity; blocking unsanctioned remote-access tools, MEGA traffic and Rclone; and forwarding logs to a central system so that Event ID 1102 (log cleared) and security-tool disablement raise an alarm.

What it means

For teams running GlobalProtect, patching is not enough on its own if the device was exposed for months: the attacks began in May and June, so a compromise may predate the patch you applied. Treat a patched device as a reason to hunt, not to close the ticket. For anyone running VMware infrastructure, the virtualisation pivot is a reminder that vCenter and ESXi management should sit behind separate controls from the user VPN, and that guest-based endpoint tools cannot see attacks on virtual disks from outside. For security teams more broadly, the case shows how a bug whose score is "only" 7.8 can become a ransomware entry point once exploitation is public.

What we don't know yet

• How many organisations were compromised. Neither Palo Alto nor Arctic Wolf gives a count.
• Whether the three named groups use the same exploit or different tooling; the sources describe them separately.
• The precise date CISA listed the flaw (sources disagree, above).
• Whether more groups are involved: ReliaQuest, as relayed by The Register, said multiple threat groups including Settra operators exploit the bug, but we have not read that report directly.

What to watch next

Watch Unit 42's threat brief and Palo Alto's advisory for updates and new indicators, and CISA's catalog entry. For a related supply-chain problem hitting developers this week, see our report on the eMudhra certificate compromise. Check that your GlobalProtect logs and your hypervisor management interfaces show nothing from the listed indicators.

Sources

• Palo Alto Networks security advisory: CVE-2026-0257
• Unit 42 threat brief: active exploitation of PAN-OS CVE-2026-0257
• Arctic Wolf: Cookie Crumbles, how exploitation of CVE-2026-0257 leads to Qilin ransomware
• The Register: Palo Alto's firewall OS has been under attack from multiple ransomware groups since June