Qilin and INC Walk Through the Front Door: A PAN-OS Flaw Opens VPN Access Without MFA
Summary
Palo Alto Networks is warning of continued exploitation of a high-severity authentication-bypass vulnerability in PAN-OS, tracked as CVE-2026-0257, which carries a CVSS score of 7.8. The flaw affects the GlobalProtect portal and gateway components and may allow an unauthenticated remote attacker to bypass authentication restrictions and establish an unauthorized VPN connection under specific configuration conditions. This poses a significant risk to corporate networks, as attackers may gain initial access without completing the expected multi-factor authentication (MFA) process.
In an October 19, 2026, update, Unit 42 reported continued exploitation attempts by ransomware operators tracked as Spikey Scorpius (aka Qilin) and Tarnished Scorpius (aka INC), alongside public reporting linking exploitation to threat actors deploying Settra ransomware. Following initial access, attackers conduct reconnaissance, move laterally through Remote Desktop Protocol (RDP) and Server Message Block (SMB), harvest credentials, exfiltrate data, and prepare ransomware deployment. One documented intrusion involved pivoting to VMware vCenter and ESXi infrastructure and extracting credentials offline from a domain controller's virtual disk. Organizations should upgrade affected deployments to the appropriate fixed versions and investigate suspicious GlobalProtect gateway sessions to identify potential compromise.
Background
CVE-2026-0257 affects the authentication process used by GlobalProtect, Palo Alto Networks' remote-access VPN solution. GlobalProtect portals and gateways can be configured to use authentication-override cookies, allowing clients to reuse an existing authentication state. Under specific configuration conditions, a weakness in cookie handling can enable an attacker to bypass authentication restrictions and establish an unauthorized VPN session.
Palo Alto Networks published its security advisory on May 13, 2026, and the vulnerability was added to the U.S. Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities (KEV) catalog on the same date. Subsequent reporting documented exploitation attempts targeting GlobalProtect infrastructure and activity linked to ransomware operations. An October 2026 update identified activity associated with Qilin and INC ransomware operators and highlighted separate public reporting that attributed exploitation to threat actors deploying Settra ransomware.
Vulnerability Details
| CVE ID | CVSS Score | EPSS Score | Affected Products | Vulnerability Type |
|---|---|---|---|---|
| CVE-2026-0257 | 7.8 (High) | 96.89% | Palo Alto Networks PAN-OS 10.2, 11.1, 11.2, 12.1; Prisma Access 10.2 and 11.2 | Authentication Bypass |
Attack Methodology
The reported activity illustrates how exploitation of CVE-2026-0257 can provide an entry point for broader intrusion campaigns involving reconnaissance, lateral movement, credential harvesting, virtualization infrastructure compromise, data exfiltration, and ransomware deployment. Reporting has linked exploitation attempts to Qilin and INC ransomware operators, with additional public reporting attributing activity to actors deploying Settra ransomware. These post-compromise techniques represent observed or reported attacker behaviors and are not automatic consequences of exploiting the vulnerability.
Indicators of Compromise (IoCs)
The following IP addresses have been associated with exploitation activity targeting CVE-2026-0257. Organizations should search GlobalProtect logs for successful gateway connection events involving these addresses, particularly activity observed before the public proof-of-concept release on May 29, 2026.
- •
23.128.228[.]6 - •
104.207.144[.]154 - •
146.19.216[.]119 - •
146.19.216[.]120 - •
146.19.216[.]125 - •
179.43.172[.]213 - •
185.195.232[.]139 - •
198.12.106[.]60 - •
202.144.192[.]47
Organizations should also search GlobalProtect logs for successful gateway-connected events from any source IP address involving suspicious host IDs or device names, including:
- •
aa:bb:cc:dd:ee:ff - •
00:11:22:33:44:55 - •
WINDOWS-LAPTOP-001 - •
DESKTOP-GP01 - •
GP-CLIENT
For post-proof-of-concept monitoring, review successful GlobalProtect gateway connection events that match the following hard-coded client configuration values associated with the proof-of-concept code:
- •
endpoint_os_version: Microsoft Windows 10 Pro 64-bit - •
source_user_info.domain: empty
MITRE ATT&CK Mapping
| Technique ID | Technique Name | Tactic |
|---|---|---|
| T1190 | Exploit Public-Facing Application | Initial Access |
| T1133 | External Remote Services | Initial Access |
| T1046 | Network Service Discovery | Discovery |
| T1021.001 | Remote Desktop Protocol | Lateral Movement |
| T1021.002 | SMB/Windows Admin Shares | Lateral Movement |
Visual Attack Flow
Mitigation
- 1. Upgrade affected PAN-OS and Prisma Access deployments: Install a fixed release for the applicable branch. Fixed releases include PAN-OS 12.1.4-h6 or 12.1.7, PAN-OS 11.2.4-h17, 11.2.7-h14, 11.2.10-h7 or 11.2.12, PAN-OS 11.1.4-h33, 11.1.6-h32, 11.1.7-h6, 11.1.10-h25, 11.1.13-h5 or 11.1.15, and PAN-OS 10.2.7-h34, 10.2.10-h36, 10.2.13-h21, 10.2.16-h7 or 10.2.18-h6, depending on the current release branch. Follow the official advisory for the exact upgrade path.
- 2. Use a dedicated certificate for authentication-override cookies: Generate a new certificate used exclusively for GlobalProtect authentication-override cookies. Do not reuse a certificate previously used for other services, even if it is removed from those services.
- 3. Disable authentication override if it is not required: Review portal and gateway settings and disable the generation or acceptance of authentication-override cookies where operationally feasible. Apply the vendor's recommended workaround if an immediate upgrade is not possible.
- 4. Hunt for suspicious successful VPN sessions: Search GlobalProtect logs for the IP addresses, hostnames, MAC addresses and client configuration values listed in the IoC section. Investigate successful gateway-connected events and correlate them with the relevant account, timestamp and source IP.
- 5. Review management interface exposure: Check whether GlobalProtect profiles unintentionally expose firewall management interfaces over HTTP/HTTPS, including ports 4443 and 3879. Restrict management access to trusted networks and follow Palo Alto Networks' interface-management guidance.
- 6. Investigate lateral movement and credential theft: Review RDP and SMB activity, RMM tool execution, credential access, vCenter and ESXi administration, and unusual access to domain controller virtual disks.
- 7. Protect backup infrastructure: Verify that Veeam and other backup systems are patched, restrict administrative access, and investigate suspicious access or exploitation attempts involving CVE-2023-27532.
- 8. Initiate incident response when suspicious activity is identified: Preserve logs, determine the scope of any unauthorized VPN sessions, investigate potential credential compromise and follow established containment and recovery procedures. Applying a patch does not by itself establish that a previously compromised environment is clean.
Instantly Fix Risks with Saner Patch Management
Saner patch management is a continuous, automated, and integrated software that instantly fixes risks exploited in the wild. The software supports major operating systems like Windows, Linux, and macOS, as well as 550+ third-party applications.
It also allows you to set up a safe testing area to test patches before deploying them in a primary production environment. Saner patch management additionally supports a patch rollback feature in case of patch failure or a system malfunction.
Experience the fastest and most accurate patching software here.
