A newly disclosed authentication bypass vulnerability in Palo Alto Networks' PAN-OS GlobalProtect and Prisma Access is already being weaponized by ransomware operators, according to threat intelligence firm ReliaQuest. Tracked as CVE-2026-0257, the flaw allows attackers to establish unauthorized VPN sessions and slip into internal corporate networks without completing standard authentication. Multiple groups, including the Qilin and Settra ransomware operations, have been observed actively exploiting the weakness.
What makes this campaign unsettling is not just the technical mechanics but the disguise it affords intruders. Rather than hammering a network from the outside through obviously suspicious connections, attackers walk in through the organization's own trusted remote-access infrastructure. A compromised VPN session can look indistinguishable from an employee logging in to work remotely, which buys attackers valuable time before credential theft, lateral movement, data exfiltration, or ransomware deployment ever begins. For organizations trying to understand how remote-access tools function day to day, including how everyday users configure and deploy VPN clients across different devices, resources like instructions for installing the app on a Firestick illustrate just how routine and unremarkable VPN connections have become, which is precisely why malicious sessions can blend in so easily.
How the Vulnerability Works
Palo Alto Networks describes CVE-2026-0257 as an authentication bypass affecting the GlobalProtect portal and gateway components. When exploited successfully, it lets attackers sidestep the usual login checks and establish VPN connections as though they were legitimate users. Crucially, the flaw does not affect every deployment equally. Exploitation depends on specific configuration choices: authentication override cookies must be enabled, paired with a particular certificate setup. Panorama and Cloud NGFW products are not affected by this issue.
That configuration dependency matters enormously for defenders. Simply running GlobalProtect does not mean an organization is exposed. Administrators need to review their portal and gateway settings against the vendor's advisory rather than assume uniform risk across deployments. The underlying problem is that the authentication mechanism in question can be tricked into granting network access without the attacker ever completing the normal login sequence, effectively handing them a shortcut into systems that should require verified credentials.
Tools and Telltale Signs of Compromise
ReliaQuest has tied related intrusions to a familiar toolkit: Cobalt Strike for command and control, alongside BloodHound and SharpHound, both commonly used to map Active Directory environments and identify paths for lateral movement. Not every intrusion uses all three tools, and attack sequences vary, but their presence alongside unauthorized VPN activity is a strong signal of deeper compromise. Investigators are also advised to scrutinize unexpected GlobalProtect sessions, including those linked to hostnames such as "kali." ReliaQuest flags this hostname as a useful investigative lead, though it should be weighed against connection history and other contextual evidence rather than treated as conclusive proof of who is behind an intrusion.
What Organizations Should Do Now
Patching alone will not undo damage already done. ReliaQuest recommends upgrading affected deployments immediately and disabling authentication override cookies wherever they are not strictly necessary. Just as important, organizations should terminate all active GlobalProtect sessions after applying patches and examine connection logs for anything unexpected. Updating software closes the door going forward, but it does not retroactively revoke access that attackers may have already secured.
- Patch GlobalProtect portal and gateway components per the vendor advisory
- Disable authentication override cookies unless operationally required
- Terminate all active VPN sessions following remediation
- Audit connection logs for anomalous hostnames or session patterns
ReliaQuest assesses that exploitation will likely remain high over the coming months, as both ransomware crews and initial access brokers continue probing for unpatched systems. The incident underscores a recurring theme in enterprise security: the tools built to enable trusted remote access can become the very pathway attackers use to appear trustworthy themselves.
