Ransomware Groups Exploit Palo Alto GlobalProtect Authentication Bypass for Stealthy VPN Access

Ransomware operators are actively exploiting a critical authentication bypass in Palo Alto Networks' PAN-OS GlobalProtect and Prisma Access, according to a new report from ReliaQuest. The vulnerability, tracked as CVE-2026-0257, allows attackers to establish unauthorized VPN sessions and slip into internal networks through trusted remote access services. Multiple threat groups, including Qilin and Settra, have been observed leveraging the flaw in recent campaigns.

The exploit's stealth stems from its abuse of legitimate VPN infrastructure. Because GlobalProtect is widely deployed as a remote access solution, malicious sessions blend in with normal employee traffic, making detection difficult for security teams that rely on traditional perimeter monitoring. Once inside, attackers can move laterally, escalate privileges, and deploy ransomware payloads.

Technical Details of CVE-2026-0257

CVE-2026-0257 is an authentication bypass vulnerability in the PAN-OS GlobalProtect portal and gateway components. It permits an unauthenticated attacker to forge authentication cookies or manipulate the login process to gain VPN access without valid credentials. Prisma Access, Palo Alto's cloud-delivered security service, is also affected because it uses the same underlying GlobalProtect technology.

Palo Alto Networks has released patches for supported PAN-OS versions. However, many organizations have yet to apply them, leaving a broad attack surface. ReliaQuest's report notes that exploitation attempts began shortly after the vulnerability's details became public, with a particular uptick in activity tied to ransomware affiliates.

Threat Actor Activity

The ReliaQuest report attributes the exploitation to multiple ransomware groups. Qilin, a prolific ransomware-as-a-service operation known for double extortion, has been linked to several intrusions that started with GlobalProtect compromise. Settra, a newer but aggressive group, is also exploiting the flaw to gain initial access.

In observed incidents, attackers used the bypass to create new VPN sessions with seemingly legitimate parameters. They then performed internal reconnaissance, harvested credentials, and moved toward high-value systems. The use of trusted remote access services allowed them to evade endpoint detection and network anomaly tools that might flag more overt attack vectors.

Detection Challenges

Security teams face a formidable detection challenge. GlobalProtect logs may show successful authentication events that appear normal, especially if attackers mimic user behavior or use compromised credentials after the initial bypass. Traditional indicators of compromise, such as malicious IP addresses or known malware hashes, may be absent during the initial access phase.

ReliaQuest recommends that defenders focus on behavioral anomalies: unusual login times, geographic impossibilities, concurrent sessions from disparate locations, and unexpected data transfers over VPN. Correlating VPN logs with endpoint and identity telemetry can help surface suspicious activity. Additionally, organizations should audit GlobalProtect configurations and ensure that multi-factor authentication (MFA) is enforced for all VPN users, as MFA can block some post-bypass actions even if the initial authentication is subverted.

Mitigation and Response

Palo Alto Networks has published security advisories and patches for CVE-2026-0257. Administrators should prioritize updating PAN-OS and Prisma Access to the latest fixed versions. If immediate patching is not possible, Palo Alto recommends restricting access to the GlobalProtect portal and gateway to trusted IP ranges, enabling threat prevention profiles, and monitoring for unusual authentication patterns.

Beyond patching, organizations should review VPN logs for signs of unauthorized access. Indicators may include new device fingerprints, sessions originating from atypical locations, or access to internal resources outside normal working hours. Incident response teams should be prepared to isolate compromised VPN sessions, reset credentials, and hunt for lateral movement.

The exploitation of CVE-2026-0257 underscores a broader trend: attackers increasingly target remote access infrastructure because it provides a direct, often trusted path into enterprise networks. As ransomware groups refine their tradecraft, the line between legitimate remote work and malicious access continues to blur, demanding more sophisticated detection strategies.

Conclusion

The active exploitation of CVE-2026-0257 by Qilin, Settra, and other ransomware operators is a stark reminder of the risks posed by unpatched VPN gateways. Organizations relying on Palo Alto GlobalProtect or Prisma Access should treat this vulnerability as an urgent priority. Patching, combined with robust monitoring and MFA enforcement, can significantly reduce the window of opportunity for attackers. As ReliaQuest's findings show, the stealth afforded by trusted remote access services makes early detection critical—and challenging.

For the latest updates on this developing story, refer to the original report from Cyber Security News: Ransomware Actors Exploiting Palo Alto GlobalProtect Flaw for Stealthy VPN Access.