Qilin and Inc ransomware still exploit the GlobalProtect auth bypass patched in May

October 20, 2026. Unit 42 updates its alert on CVE-2026-0257, an authentication bypass in the GlobalProtect portal and gateway of PAN-OS. May 13, 2026. The CVE enters the CISA KEV catalog. October 20, 2026, again. The Spikey Scorpius (Qilin) and Tarnished Scorpius (Inc) ransomware groups are still exploiting it, five months after the fix. Why it matters: an exposed, unpatched VPN gateway remains the most profitable front door into a whole domain.

The flaw: opening a legitimate VPN session without authenticating

CVE-2026-0257 is an authentication bypass in the portal and gateway components of GlobalProtect, the remote-access layer of Palo Alto Networks firewalls. In practice, an unauthenticated attacker can slip past the controls and initiate a VPN connection without valid credentials.

The detail that makes the flaw so dangerous is the authentication override cookie. This mechanism, meant to allow a session without a second round of authentication, can be abused to defeat MFA. The result is not a degraded foothold but a fully legitimate VPN session, equivalent to a remote worker’s. The firewall sees nothing unusual: the connection carries the attributes of a trusted user.

The CVE is rated CVSS 9.1 (critical), and its EPSS score reaches 96.9% — among the flaws most likely to be exploited within 30 days. It was added to the CISA Known Exploited Vulnerabilities catalog on May 13, 2026, evidence that active exploitation was already documented by then.

Five months between the patch and active exploitation

The timeline tells a story security teams know all too well: patch lag. The flaw has been fixed since May 2026 — the affected branches (10.2, 11.1, 11.2, 12.1, plus certain Prisma Access releases) all have patched versions. A public proof of concept has circulated since May 29, 2026. And yet, on October 20, 2026, Unit 42 is still observing successful exploitation attempts.

On October 19, 2026, Unit 42 confirmed the involvement of Spikey Scorpius (aka Qilin) and Tarnished Scorpius (aka Inc), two established ransomware groups. Public reporting separately attributes exploitation to actors using the Settra ransomware. Those three names are not incidental: they show the flaw has moved from technical curiosity to the initial-access arsenal of criminal groups.

The key point, stressed by Unit 42, is that only a small fraction of probed devices actually establish a VPN session. But a handful of successful sessions is enough: one exposed gateway becomes an entry point, then a pivot.

What attackers do once the session is open

A legitimate VPN session opens the door to the internal network. The post-access behavior documented by Unit 42 follows a now-classic but brutal script.

First, reconnaissance with RMM (remote monitoring and management) tools: legitimate, signed software that blends into the noise of an enterprise estate. Then lateral movement over RDP and SMB, and credential harvesting. In one documented case, the attackers reached vCenter, disabled ESXi protections, then dumped domain credentials offline from a VMDK file.

The chain does not stop at the CVE itself: some actors follow it with other flaws, including CVE-2023-27532, a Veeam vulnerability patched back in 2023. The lesson is twofold. A critical VPN flaw is rarely exploited alone, and a single unpatched legacy CVE in the estate is enough to carry the compromise all the way to the domain controller.

The presence of RMM tools deserves particular attention. These legitimate agents — remote take-over tools, fleet-monitoring agents — are signed, present by default on many machines, and rarely blocked by security policy. An attacker who abuses them gains a persistence and movement channel that blends into the normal activity of the business. The hunt must therefore target not the tool itself but its abnormal use: execution from an unusual account, from a guest-network host, or at hours that match no support activity.

One more hunt signal deserves explanation. The PoC hard-codes a client configuration with an empty domain field and a fixed OS string (Microsoft Windows 10 Pro 64-bit). A successful gateway connection carrying those exact values is close to a smoking gun, because no legitimate client registers an empty domain. Unit 42 also flags host IDs such as aa:bb:cc:dd:ee:ff and device names like WINDOWS-LAPTOP-001 — values no real endpoint would claim.

The Lunar Peak precedent: the management surface remains the weak spot

Unit 42’s update does not stop at the CVE. It repeats a recurring finding from its incident-response work, tied to the Lunar Peak campaign — the CVE-2024-0012 and CVE-2024-9474 flaws, exploited in late 2024. The most common misconfiguration: teams that map GlobalProtect profiles to the HTTP/HTTPS services of the management interface.

The direct consequence is that the firewall’s admin interface, meant to stay unreachable from outside, ends up reachable from the internet. Unit 42 recommends verifying that the management interface is exposed on no external interface, and restricting admin access to dedicated IP addresses or an isolated management network.

That is the second lesson of the case: the VPN flaw is the door, but it is often a misconfigured management surface that turns initial access into full control of the device. The two must be addressed in the same remediation pass, not one without the other.

What to do now

The priority remediation comes down to one action, then a check.

• Patch immediately. Move to the fixed releases: 12.1.7, 11.2.12, 11.1.15, 10.2.18-h6 (or the equivalent hotfixes), plus the matching Prisma Access versions. If an upgrade is impossible in the short term, apply the documented workaround from Palo Alto Networks: disable Authentication Override.
• Hunt in GlobalProtect logs. Look for successful gateway-connected events matching the indicators Unit 42 published: specific IP addresses, suspicious host IDs (aa:bb:cc:dd:ee:ff, 00:11:22:33:44:55, WINDOWS-LAPTOP-001), an empty domain field in the client configuration, or hard-coded values from the PoC.
• Treat any successful session as a compromise. If a gateway-connected event matches the indicators, isolate the host, rotate credentials, and trigger incident response. Do not stop at patching: the access may have been used to install persistence.
• Shrink the exposed surface. Inventory every GlobalProtect portal reachable from the internet. An enterprise VPN gateway has no reason to be findable by a scanner without additional protection in front of it.
• Verify exposure programmatically. Use an external scanner — Cortex Xpanse, Shodan, or your own asset inventory — to confirm no management interface or GlobalProtect portal is reachable from the internet. An exposed gateway you did not know about is the one most likely to be found first by a ransomware operator.

Verdict

If you run an exposed PAN-OS firewall, the question is not whether you are being targeted but whether your installed version postdates May 2026 — check it today, and disable Authentication Override until the patch lands. If you oversee a wider estate, take the quantified rule: a VPN flaw at CVSS 9.1 and EPSS 96.9%, patched five months ago, is still being exploited by three ransomware groups. Patch lag is not a compliance detail — it is the window you hand a criminal group to turn an authentication bypass into domain control.

References

• Unit 42 — Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257 (October 20, 2026)
• Palo Alto Networks — Security Advisory CVE-2026-0257
• CISA — Known Exploited Vulnerabilities Catalog
• Rapid7 — Technical analysis of CVE-2026-0257 exploitation
• NVD — CVE-2026-0257