A high-severity flaw in Palo Alto Networks' GlobalProtect VPN software is being actively exploited by ransomware operators to slip past multi-factor authentication and establish footholds inside corporate networks. Unit 42, the company's threat intelligence arm, detailed the activity in an October 19 update, tying exploitation to groups tracked as Spikey Scorpius, also known as Qilin, and Tarnished Scorpius, also known as Inc, with separate reporting linking the same flaw to operators deploying Settra ransomware.
Investigations spanning early June through the present have touched healthcare providers, universities, financial institutions, manufacturers, government agencies, and energy companies. The breadth of victims underscores a recurring problem in enterprise security: a single authentication weakness in widely deployed remote-access software can cascade into full network compromise across unrelated industries.
How the Bypass Works
The vulnerability, cataloged as CVE-2026-0257, affects GlobalProtect portals and gateways in certain PAN-OS and Prisma Access configurations, though Panorama and Cloud NGFW deployments are not exposed. Exploitation requires two conditions to be present at once: authentication override cookies must be enabled, and the certificate used to validate those cookies must be configured in a vulnerable way. Palo Alto Networks has rated the issue High severity, with a CVSS score of 7.8, and assigned it its most urgent response category.
Authentication override cookies exist for convenience. They let users who have already logged in reconnect without repeating the full authentication sequence, including MFA prompts. According to technical analysis from Rapid7, the underlying problem is that vulnerable devices decrypt these cookies without properly confirming that a trusted system actually issued them. If the same certificate is reused on a publicly accessible service, an attacker can recover its public key and forge a valid-looking cookie. The gateway then accepts that forged token as proof of a prior login, granting VPN access without the normal credential and MFA checks ever occurring.
This is a meaningful distinction from brute-force or phishing-based MFA bypasses. Here, the attacker never needs a password or a one-time code at all. They exploit a trust assumption baked into the convenience feature itself, which is precisely why the flaw is so valuable to ransomware crews seeking quiet, low-friction entry points.
From VPN Access to Domain Controller Theft
Once inside, attackers in the cases Unit 42 examined relied on remote monitoring and management tools to map internal networks, then moved laterally using Remote Desktop Protocol and Server Message Block, the standard channels for file sharing and remote administration in Windows environments. From there, they staged tools for credential harvesting and data theft ahead of ransomware deployment.
The most striking case involved a pivot from the compromised VPN gateway directly into VMware's vCenter management appliance, the control plane for an organization's virtualized servers. Once there, attackers disabled the execInstalledOnly security control on ESXi hosts, a protection meant to restrict which software can run on the hypervisor, and used a custom tool to pull credentials offline from a domain controller's VMDK virtual disk file. Unit 42 did not disclose the tool's name or technical workings.
This method matters because it sidesteps endpoint detection and response software running inside the virtual machine entirely. Rather than executing a credential-stealing program on the domain controller itself, where security tools might catch it, attackers reach underneath the operating system and read the raw disk image directly from the virtualization layer. It is an approach that treats the infrastructure hosting a system as the weak point, rather than the system's own defenses.
A Widening Attack Surface Around Infrastructure
Unit 42 also observed the same intrusion pattern paired with tools aimed at Veeam backup infrastructure through a separate, older flaw, CVE-2023-27532, which can expose encrypted credentials stored in Veeam's configuration database and potentially open access to backup hosts. Combining VPN compromise, hypervisor-level credential theft, and backup infrastructure targeting gives ransomware operators multiple paths to both encrypt production systems and destroy or steal the backups organizations would otherwise rely on for recovery.
Defenders are advised to review GlobalProtect logs for successful gateway connections tied to suspicious source addresses or client identifiers, including the IP addresses 104.207.144[.]154 and 146.19.216[.]125, device names such as GP-CLIENT and DESKTOP-GP01, and host identifiers aa:bb:cc:dd:ee:ff and 00:11:22:33:44:55. Earlier monitoring found that many probing attempts never completed a full VPN session, which makes reviewing actual connection events, rather than failed attempts alone, essential to catching real intrusions.
Palo Alto Networks is urging all customers to apply its advisory and patch every affected portal and gateway without delay. Where immediate patching is not possible, the company recommends disabling authentication override entirely or issuing a new certificate used exclusively for override cookies, separating that function from certificates shared with other public-facing services.