GlobalProtect vulnerability CVE-2026-0257: legitimate or rogue VPN session? 5 urgent steps
Ransomware groups, including Qilin and Settra, are exploiting the GlobalProtect vulnerability CVE-2026-0257 to open VPN sessions into company networks without any password. According to a report by ReliaQuest covered on October 11, 2026, attackers forge an authentication cookie and connect through the victim’s own VPN. Their session then looks like ordinary remote work.
GlobalProtect is the VPN built into Palo Alto Networks firewalls, also offered in Prisma Access. Palo Alto published the advisory and patches on May 13, 2026; companies that haven’t updated yet are now being targeted.
Who is affected?
- Products: PAN-OS 12.1, 11.2, 11.1 and 10.2, plus Prisma Access 11.2 and 10.2. Panorama and Cloud NGFW are not affected.
- Condition: the GlobalProtect portal or gateway uses authentication override cookies with a specific certificate configuration, for example a reused certificate. It isn’t the default setting, but it’s common to spare employees from signing in over and over.
- After getting in: ReliaQuest observed tools such as Cobalt Strike, BloodHound and SharpHound, used to map the network before ransomware.
Legitimate or rogue VPN session? Signs to watch
| Sign | ✅ Legitimate session | 🚩 Possible rogue session |
|---|---|---|
| Device name | A known company device (e.g. LAPTOP-ACCT-02) | An unknown or generic name, for example “kali” (a common attacker tool) |
| Sign-in | A successful authentication, with MFA, visible in the logs | A VPN session with no matching authentication in the logs |
| Time and origin | The employee’s usual hours and regions | Unusual time, unexpected country or internet provider |
| What happens next | Email, shared files, usual business apps | Network scanning, mass Active Directory queries, remote admin tools |
| Data volume | Normal for the person’s role | Large outbound transfers or access to servers this employee never uses |
A single sign proves nothing (a “kali” device name is an investigation lead, not proof). It’s the combination that should raise the alarm.
GlobalProtect vulnerability: 5 urgent steps
Check whether you’re affected, then patch
The flaw affects GlobalProtect portals and gateways where authentication override cookies are enabled with a specific certificate configuration. Apply the PAN-OS update on every portal and gateway, internal and external.
Terminate all active VPN sessions
After updating, end every open session: a session an attacker opened before the patch can stay active. Users will need to sign in again once.
Disable authentication override or change the certificate
If you don’t need this feature, turn it off. Otherwise, use a new certificate dedicated to these cookies only, never the portal’s certificate.
Restrict portal access and require MFA
If you can’t patch right away, limit the VPN portal to trusted IP addresses and require multi-factor authentication for every connection.
Review VPN sessions since May 2026
Look for the signs in the table above: unknown devices, sessions with no authentication, unusual network activity. If in doubt, treat it as an incident.
🔍 Why behavioural detection matters here
With the GlobalProtect vulnerability, the attacker has no stolen password and no malware at the door: they use your own VPN. Antivirus and password policies see nothing. What gives them away is their behaviour: a device never seen before, a connection at 3 a.m., then a network scan.
To catch it in time, you need to know what normal looks like for you and get alerted when it changes. That’s the job of automated 24/7 monitoring with on-call technician response, which connects VPN, firewall and workstation logs.
VPNs and firewalls have become attackers’ favourite way in, as shown by the SonicWall SMA1000 vulnerability and FortiBleed at Fortinet. See our cyber monitoring service and our cybersecurity services.
Book your free cyber check
Is your VPN up to date, and could you spot a rogue session? Our free cyber check reviews your remote access, firewall and logs, and gives you a clear, jargon-free plan.
Call us at 438-476-2322 or email info@neotechcloudsolutions.com.
Sources
- Palo Alto Networks — CVE-2026-0257 PAN-OS: GlobalProtect Authentication Bypass Vulnerabilities
- Cyber Security News — Ransomware Actors Exploiting Palo Alto GlobalProtect Flaw for Stealthy VPN Access (ReliaQuest)
- Rapid7 — Observed Exploitation of PAN-OS GlobalProtect Authentication Bypass (CVE-2026-0257)
- CyberStack — GlobalProtect auth bypass CVE-2026-0257: Qilin and Settra now use it for VPN access (Oct 11, 2026)
Photo: cottonbro studio, Pexels (Pexels licence).