A vulnerability in Palo Alto Networks' GlobalProtect VPN software is giving ransomware groups a way into corporate networks that sidesteps multi-factor authentication altogether. Unit 42, the company's threat intelligence arm, disclosed in an October 19 update that the flaw, tracked as CVE-2026-0257, has already been exploited by groups linked to the Qilin and Inc ransomware operations, with separate reporting tying it to attacks involving Settra ransomware as well.
Investigators have been tracking the activity since early June, with victims spread across healthcare, education, financial services, manufacturing, government, and energy. The pattern that emerges is unsettling precisely because it does not rely on stolen passwords or tricked employees. It exploits a design assumption baked into how VPN gateways recognize returning users.
How the Bypass Actually Works
GlobalProtect, like many enterprise VPN products, uses what are called authentication override cookies. The idea is convenience: once a user has logged in and passed MFA, the gateway issues a cookie so that reconnecting later does not require repeating the entire process. In principle, only a trusted system should be able to generate a valid cookie.
According to technical analysis from security firm Rapid7, affected GlobalProtect devices decrypt these cookies correctly but fail to confirm that a legitimate, trusted source actually created them. If the same certificate used for the cookie is also exposed through another public-facing service, an attacker can retrieve its public key and forge a cookie of their own. Presented to the gateway, that forged cookie is accepted as proof the user already authenticated - no password, no MFA prompt, no alarm.
Palo Alto Networks rates the issue as High severity, with a CVSS score of 7.8, and has urged customers to treat patching with its highest priority. Exposure depends on two conditions being present together: authentication override cookies must be enabled, and the certificate configuration must be the vulnerable type. Panorama and Cloud NGFW deployments are not affected, which narrows the exposure but does not shrink the risk for organizations running standard PAN-OS or Prisma Access gateways.
From Network Access to a Domain Controller's Disk
Gaining a VPN session is only the opening move. Unit 42's investigations show attackers deploying remote monitoring and management tools once inside, then moving across the network using Remote Desktop Protocol and Server Message Block to map out systems worth targeting.
The most striking case documented involved a pivot from the compromised VPN gateway straight to VMware's vCenter management appliance. From there, attackers disabled a security control called execInstalledOnly on the organization's ESXi hosts, which normally restricts what software can run on the hypervisor. With that control disabled, they used a custom tool to pull credentials directly from a domain controller's virtual disk file - offline, without ever triggering the endpoint detection software running inside that domain controller's own operating system.
That detail matters. Endpoint detection and response tools watch what happens inside a virtual machine. They cannot see an attacker reading the raw disk file from the underlying virtualization layer, because from the perspective of the operating system, nothing happened at all. It is a reminder that infrastructure sitting beneath the systems administrators normally monitor can be just as valuable a target, and just as poorly defended.
Unit 42 also found the same intrusions reaching toward Veeam backup infrastructure through a separate, older flaw, CVE-2023-27532, which can expose encrypted credentials stored in backup configuration databases. Combined, the two weaknesses give attackers a path not just into live systems but into the backups meant to help organizations recover from exactly this kind of attack.
What Defenders Should Do Now
Palo Alto Networks has published patches for every affected portal and gateway configuration, and organizations running GlobalProtect should apply them without delay. Where immediate patching is not feasible, the company recommends disabling authentication override entirely or issuing a new certificate used exclusively for override cookies, separate from any certificate exposed through other services.
- Review GlobalProtect logs for gateway-connected events tied to unfamiliar source addresses or device identifiers
- Treat successful connection events as more significant than failed probes, since many scanning attempts never complete a full session
- Audit whether the same certificate is reused across multiple public-facing services
- Confirm execInstalledOnly and related ESXi security controls have not been silently disabled
The episode fits a broader shift in ransomware tradecraft. Attackers are increasingly bypassing endpoint protection by targeting the virtualization and identity infrastructure underneath it, rather than fighting detection tools on their own terrain. For organizations that treat MFA as a solved problem, this case is a pointed reminder that the mechanism verifying "already authenticated" can be forged just as surely as a password can be stolen.