Ransomware Actors Exploit Palo Alto VPN Flaw to Bypass MFA and Steal Credentials

Ransomware operators are actively exploiting a vulnerability in Palo Alto Networks GlobalProtect VPN systems to bypass multi-factor authentication, according to threat intelligence from Palo Alto Networks Unit 42. The attackers use this unauthorized access to infiltrate corporate networks and harvest sensitive credentials.

Palo Alto Networks Unit 42 linked the exploitation of CVE-2026-0257 to ransomware groups known as Spikey Scorpius (Qilin) and Tarnished Scorpius (Inc). Separate public reports have also connected the flaw to operators using Settra ransomware. These actors are leveraging the authentication bypass to establish VPN connections without normal login and MFA checks.

Technical Mechanics and Impact

The vulnerability affects GlobalProtect portals and gateways in specific PAN-OS and Prisma Access deployments. Exposure requires that authentication override cookies are enabled alongside a vulnerable certificate configuration. Palo Alto Networks rates the flaw High severity, assigning it a CVSS score of 7.8 and its highest suggested response urgency.

According to technical analysis by Rapid7, vulnerable devices decrypt authentication override cookies but fail to verify that a trusted system created them. If an attacker obtains the public key for a certificate reused on a publicly exposed service, they can forge a valid cookie. The gateway accepts this forged cookie as proof of authentication, granting VPN access without multi-factor checks.

Investigations ongoing since early June involve sectors including healthcare, education, financial services, manufacturing, government, and energy. The latest findings demonstrate how initial VPN access evolves into credential theft, data exfiltration, and ransomware deployment. Panorama and Cloud NGFW products are not affected by this specific vulnerability.

Post-Exploitation Tactics

After establishing access through the compromised gateway, attackers use remote monitoring tools to explore internal networks. They move laterally using Remote Desktop Protocol and Server Message Block protocols. This movement allows them to position tools for credential harvesting and eventual ransomware deployment.

In one investigated case, attackers moved from the compromised VPN gateway to VMware’s vCenter management appliance. They disabled the execInstalledOnly security control on ESXi hosts to expand their capabilities. Subsequently, they used a custom tool to extract credentials offline from a domain controller’s VMDK virtual disk, bypassing security tools running inside the virtual machine.

As Threat Times reported on October 19, ransomware groups including Qilin and Inc were already exploiting this PAN-OS flaw to establish VPN sessions, indicating sustained operational interest in this attack vector.

What should you do?

Organizations should verify their GlobalProtect configurations immediately, specifically checking for the use of authentication override cookies. Review certificate management practices to ensure keys used for cookie validation are not exposed on public-facing services. Monitor network logs for unusual VPN connections that bypass standard multi-factor authentication flows.

Background: Certificate management

Effective certificate management requires automated lifecycle tracking, strict validation of trust chains, and immediate revocation processes. Manual oversight fails at scale, leading to service outages or trust bypasses. Use standardized protocols and centralized inventory tools to maintain security posture without constant manual intervention.

Read the full guide: Certificate Management FAQs: Fixing Expiry, Rotation, and Trust

What to do and how to stay safe: Palo Alto Networks

• Audit GlobalProtect portals and gateways to determine if authentication override cookies are enabled and assess exposure risk.
• Ensure certificates used for cookie validation are not reused on publicly accessible services to prevent key extraction.
• Monitor internal network traffic for lateral movement via Remote Desktop Protocol and Server Message Block from VPN endpoints.
• Implement strict controls on VMware vCenter and ESXi hosts to prevent unauthorized disabling of security controls like execInstalledOnly.

Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which ransomware groups are exploiting this vulnerability?

Palo Alto Networks Unit 42 linked the exploitation to Spikey Scorpius (Qilin) and Tarnished Scorpius (Inc), while other reports mention Settra operators.

Is this vulnerability affecting all Palo Alto products?

No, Panorama and Cloud NGFW are not affected; the flaw impacts specific GlobalProtect portals and gateways in certain PAN-OS and Prisma Access deployments.

How are attackers stealing credentials from virtual disks?

Attackers disable security controls on ESXi hosts and use custom tools to extract credentials offline from a domain controller’s VMDK virtual disk.