A serious authentication bypass vulnerability in Palo Alto Networks' GlobalProtect VPN software is now being actively exploited by ransomware operators, according to new research from threat intelligence firm ReliaQuest. The flaw, tracked as CVE-2026-0257, allows attackers to establish unauthorized VPN sessions and walk into corporate networks through a channel defenders are trained to trust. Among the groups identified using this technique are the Qilin and Settra ransomware operations, both known for targeting enterprise environments with extortion-driven campaigns.
What makes this exploitation method particularly dangerous is its disguise. Rather than triggering alerts associated with suspicious external connections, attackers who abuse this flaw enter through an organization's own remote-access infrastructure, making their early activity resemble ordinary employee logins. This is a sharp departure from the blunt-force intrusion attempts security teams typically watch for, and it underscores why VPN configuration hygiene matters as much as perimeter defense. For IT administrators puzzling over unusual latency or connection drops, it's worth remembering that not every anomaly is malicious; legitimate issues like troubleshooting a slow VPN connection remain common and should be ruled out before assuming compromise, even as vigilance around authentication logs becomes essential. troubleshooting a slow VPN connection
Palo Alto Networks has described the issue as an authentication bypass affecting both the GlobalProtect portal and gateway components. Successful exploitation lets intruders sidestep standard login verification entirely, effectively handing them a legitimate-looking session without ever proving who they are. Crucially, exposure depends on specific configuration choices: the vulnerability only manifests when authentication override cookies are enabled alongside a particular certificate setup. Panorama and Cloud NGFW deployments are not affected, and simply running GlobalProtect does not mean an organization is at risk. Administrators need to check their actual portal and gateway settings against the vendor's advisory rather than assume uniform exposure across deployments.
A Familiar Toolkit Follows Initial Access
Once inside, attackers observed by ReliaQuest have deployed a recognizable post-exploitation toolkit, including Cobalt Strike for command-and-control operations and BloodHound alongside SharpHound for mapping Active Directory relationships and identifying privilege escalation paths. These tools are staples of modern intrusion operations, valued precisely because they let attackers move efficiently from a single foothold toward domain-wide control. ReliaQuest cautions that not every intrusion follows an identical sequence or uses all three tools, but their presence signals a mature, well-resourced operation rather than opportunistic probing.
Investigators are encouraged to scrutinize unexpected GlobalProtect sessions, including those tied to hostnames such as "kali" - a detail that may hint at the use of Kali Linux, a distribution favored for penetration testing and, in this context, potentially for offensive operations. ReliaQuest is careful to frame this as an investigative lead rather than proof of attribution, urging analysts to weigh it against connection history and other contextual evidence.
Patching Is Necessary But Not Sufficient
Organizations running affected configurations should apply vendor patches without delay and disable authentication override cookies wherever they are not strictly required. But ReliaQuest stresses a point that often gets lost in incident response: updating the software closes the vulnerability going forward, but it does nothing to remove access attackers may have already secured. Teams should terminate all active GlobalProtect sessions after patching and audit connection logs for anything irregular, treating the vulnerability and any existing unauthorized access as two separate problems requiring separate remediation.
ReliaQuest assesses that exploitation will likely remain active over the coming months, as ransomware affiliates and initial access brokers continue scanning for unpatched systems. The firm has published a set of indicators of compromise, including four IPv4 addresses, to support detection efforts, though it has not detailed their precise operational function within observed attacks. Security teams are advised to incorporate these indicators into existing monitoring alongside behavioral analysis of VPN activity, since static indicators alone rarely capture the full picture of an evolving campaign.