PAN-OS CVE-2026-0257: Ransomware Moves Beyond the VPN

Ransomware operators are using PAN-OS CVE-2026-0257 to establish unauthorized GlobalProtect VPN sessions, and Unit 42’s October 19 update documents activity reaching virtual infrastructure. Patch or mitigate the affected portal and gateway configuration, then investigate successful suspicious sessions beyond the VPN. The vulnerability was disclosed in May; this October update describes later findings, not a newly discovered flaw.

This is not just another patch notice. GlobalProtect sits at the edge of many networks, so a bypassed VPN login can become the starting point for internal reconnaissance, credential theft, lateral movement, or abuse of trusted access. Admins should treat exposed portals and gateways as incident-review targets, not only as devices to update.

October 20 update: the VPN foothold reached virtual infrastructure

Unit 42’s October 19 update describes ongoing exploitation by Qilin and Inc ransomware operators. Its investigations, running since early June, now include internal reconnaissance through remote-management tools, lateral movement over RDP and SMB, credential harvesting and ransomware deployment. This is a later incident-response picture than the report’s original account of access attempts without observed lateral movement.^[3]

In one case, attackers moved from the compromised VPN gateway to vCenter, the platform managing the organization’s virtual infrastructure. They disabled the ESXi execInstalledOnly protection and used a custom tool to extract credentials offline from a domain controller’s virtual disk, or VMDK. Reading the disk from the infrastructure side bypassed security monitoring inside the guest operating system. That case does not establish that every compromised gateway led to domain-wide access.

The response therefore has two boundaries: close the VPN entry path, then investigate where that session went. Correlate suspicious successful gateway-connected events with RMM activity, RDP/SMB access, vCenter logins, ESXi configuration changes and access to domain-controller disks. Preserve those records and involve incident responders if evidence points beyond the gateway; an absence of workstation alerts cannot clear activity performed outside the virtual machine.

Unit 42 also lists suspicious client identifiers such as aa:bb:cc:dd:ee:ff, WINDOWS-LAPTOP-001 and GP-CLIENT, plus a hard-coded Windows 10 Pro client string used in public exploit code. Use these as hunting pivots with session context, not as standalone proof or a complete detection rule. Its published source-IP list covers an earlier pre-public-exploit period, so checking only those addresses would be too narrow.

October 20 guidance: check unintended management access

Unit 42’s October 20 guidance adds a separate configuration check. During Lunar Peak incident response, investigators repeatedly found GlobalProtect profiles mapped to HTTP/HTTPS services on management interfaces, exposing management access to the internet on ports such as 4443 and 3879. From an external network, authorized administrators should check HTTPS reachability of their own management IP on those ports. An exposed management page identifies access to restrict; it does not itself establish exploitation of CVE-2026-0257.^[3]

Review Network → Network Profiles → Interface Mgmt and the interfaces using those profiles. Palo Alto’s configuration guide says to keep management services off internet-facing or otherwise untrusted interfaces. For interfaces where management is required, limit access to trusted administrative addresses; an empty Permitted IP Addresses list imposes no IP restriction. The dedicated MGT interface has separate access settings and does not use an Interface Management profile. Check both paths as applicable rather than treating a VPN patch as a management-access fix.^[4]

Who is affected

The Palo Alto advisory says the issue affects PAN-OS firewalls with a GlobalProtect portal or gateway configured when authentication override cookies are enabled and a specific certificate configuration exists. Panorama and Cloud NGFW are not impacted. Prisma Access customers are being upgraded according to the vendor’s schedule.

Fixed versions and mitigations

Palo Alto lists fixed PAN-OS releases across the 12.1, 11.2, 11.1, and 10.2 branches. The shortest safe rule is to move to the fixed release for your branch or a later supported release named in the vendor advisory. Unsupported PAN-OS versions should be upgraded to a supported fixed version.

If you cannot patch immediately, reduce exposure by disabling Authentication Override on the GlobalProtect portal and gateway, or by generating a new certificate used only for authentication override cookies. Do not reuse the portal or gateway certificate for that purpose. After patching, expect GlobalProtect users to re-authenticate because the fix regenerates authentication override cookies with a more secure method.

What to check after patching

1. Inventory all internet-facing GlobalProtect portals and gateways, including standby or branch devices that may be forgotten.
2. Confirm the PAN-OS branch and hotfix level against Palo Alto’s fixed-version table.
3. Check whether authentication override cookies are generated or accepted on the portal and gateway.
4. Review recent VPN sessions for unusual countries, hosting providers, impossible travel, short-lived sessions, or accounts that rarely use VPN.
5. Look at what happened after VPN access: admin logins, new remote-management traffic, file-share access, suspicious PowerShell, scheduled tasks, or endpoint alerts.
6. Reset or revoke sessions for suspicious accounts, rotate credentials where access is uncertain, and scan affected endpoints with a trusted security tool such as Gridinsoft Anti-Malware when workstation activity looks abnormal.

For context, Gridinsoft recently covered another exploited Palo Alto Networks issue, PAN-OS CVE-2026-0300 root RCE. CVE-2026-0257 is a different bug, but the operational lesson is similar: edge security appliances need fast patching plus log review because successful exploitation may not leave the same signals as commodity malware.

Another management-plane issue now needs a separate response: Check Point SmartConsole CVE-2026-16232 is being exploited against management systems exposed directly to the internet without IP restrictions.

FAQ

References

1. Palo Alto Networks. “CVE-2026-0257 PAN-OS: GlobalProtect Authentication Bypass Vulnerabilities.” Palo Alto Networks Security Advisories, published May 13, 2026; updated June 3, 2026; accessed October 20, 2026. https://security.paloaltonetworks.com/CVE-2026-0257
2. Cybersecurity and Infrastructure Security Agency. “Known Exploited Vulnerabilities Catalog.” CISA, CVE-2026-0257 added May 29, 2026; accessed October 20, 2026. https://www.cisa.gov/known-exploited-vulnerabilities-catalog
3. Palo Alto Networks Unit 42. Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257. Updated October 20, 2026; accessed October 20, 2026.
4. Palo Alto Networks. Use Interface Management Profiles to Restrict Access. Technical documentation; accessed October 20, 2026.