CVE-2026-0257 (CVSS 7.8): Qilin, INC & Settra Ransomware Exploit PAN-OS GlobalProtect — Attackers Now Pivot to ESXi

On the evening of 20 October 2026, Palo Alto Networks’ Unit 42 research team updated their threat brief on CVE-2026-0257 with findings that should alarm any security team running GlobalProtect VPN. What began as a quietly-patched authentication-bypass flaw in May has now been weaponised by three distinct ransomware gangs — and in at least one documented incident, attackers jumped straight from the VPN appliance into the organisation’s virtualisation layer, disabling ESXi protections and extracting credentials offline from a domain controller’s virtual disk. If your organisation has not yet patched PAN-OS GlobalProtect, your network boundary may already have been the entry point for a ransomware precursor attack.

What Is CVE-2026-0257?

CVE-2026-0257 is an authentication bypass vulnerability in the GlobalProtect portal and gateway components of Palo Alto Networks PAN-OS. The root cause is subtle but devastating: vulnerable builds accept any authentication override cookie they can decrypt, without verifying that the appliance itself actually issued that cookie. An attacker who can create or obtain a validly-formatted cookie — whether through a second compromised device in the same certificate trust chain, a leaked or reused certificate, or a brute-force approach against weak HMAC keys — can present it as proof of a legitimate authenticated VPN session.

Palo Alto initially scored the flaw at CVSS 4.7 (Medium) when patches were released in May 2026. On 29 May 2026, Rapid7 published a technical analysis and working proof-of-concept exploit; within 48 hours Palo Alto revised the official CVSS score upward to 7.8 (High). Singapore’s Cyber Security Agency assessed the same flaw at CVSS v3.1 9.1 — a reminder that CVSS arithmetic can diverge significantly depending on assumed environmental factors. CISA added CVE-2026-0257 to its Known Exploited Vulnerabilities catalog with a federal remediation deadline of 1 June 2026. With three active ransomware crews now exploiting it and an ESXi pivot technique confirmed, the risk is far higher than the vendor headline score suggests.

Technical Breakdown: How the Bypass Works

GlobalProtect’s authentication override feature lets an authenticated user obtain a cookie from one gateway and present it at another, avoiding repeated MFA challenges across multiple sites. The feature is not enabled by default — an administrator must explicitly turn it on. However, many large enterprises and distributed organisations activate it for usability, especially in SD-WAN or multi-site deployments common across Indian enterprise campuses.

The bypass exploits three conditions that must all be true simultaneously:

1. GlobalProtect portal or gateway is configured and internet-facing
2. Authentication override cookies are enabled
3. The certificate used to sign override cookies is either reused across multiple appliances or is otherwise accessible to the attacker (e.g., leaked private key, certificate shared with a compromised third-party gateway)

When these conditions align, an attacker forges or replays a valid override cookie, bypasses the login prompt entirely, and establishes a full VPN tunnel — appearing to PAN-OS logs as a legitimate user session. No username or password is required. Once inside, the attacker has Layer-3 access to whatever the VPN segment can reach, which in typical enterprise architectures includes internal file shares, Active Directory, backup servers, and virtualisation management planes.

According to Unit 42’s updated threat brief (20 October 2026), Palo Alto also provides a temporary CLI workaround — a command that disables strict HMAC validation on override cookies — intended only for phased upgrades where not all gateways can be patched simultaneously. Organisations that have left this workaround in place permanently have effectively disabled the only protection against cookie forgery.

Three Ransomware Gangs — and a Dangerous ESXi Pivot

Unit 42 attributes active exploitation to two ransomware operators it tracks under its Scorpius naming convention. ReliaQuest and The Hacker News have additionally documented a third group deploying Settra ransomware via the same entry point.

Unit 42 Alias	Public Name	Ransomware	Notable TTPs
Spikey Scorpius	Qilin	Qilin / Agenda	Active Directory credential theft, ESXi encryption
Tarnished Scorpius	INC	INC Ransom	Double extortion, healthcare & education targeting
—	Settra	Settra	RaaS affiliate model, SMB & mid-market focus

The most alarming aspect of the October 20 update is the ESXi pivot technique. In at least one confirmed intrusion, after gaining VPN access through CVE-2026-0257, attackers pivoted laterally to vCenter — the management plane for the organisation’s entire virtualised infrastructure. They then:

1. Disabled the execInstalledOnly security control on ESXi hosts (which normally prevents execution of arbitrary binaries)
2. Mounted the virtual disk (VMDK) of a domain controller from outside the guest OS, bypassing endpoint detection entirely
3. Extracted Active Directory credentials, password hashes, and Kerberos tickets offline — no alerting SIEM rule for “unusual logon” fires because there was no logon inside the guest

This technique effectively turns a medium-severity VPN bypass into a full domain compromise, all without generating the in-guest behavioural signals that most EDR and SIEM tools are tuned to catch. The lesson: patching the VPN is necessary but not sufficient — any organisation that was exposed before patching must conduct a full threat hunt across its virtualisation layer and AD environment.

What You Should Do — Sanjay Seth’s Practical Guidance

After 30 years of defending enterprise networks across India and the region, including multi-site zero-trust deployments with both Fortinet and Palo Alto stacks, my recommendation is structured around three horizons:

Immediate (Within 24 Hours)

• Verify your exposure: Check whether GlobalProtect portal/gateway is configured, authentication override cookies are enabled, and your certificate is shared across multiple appliances
• Patch now — see verified fixed builds from Palo Alto Networks’ security advisory:
  • PAN-OS 12.1: 12.1.4-h6 or 12.1.7+
  • PAN-OS 11.2: 11.2.4-h17, 11.2.7-h14, or later hotfixes
  • PAN-OS 11.1: 11.1.4-h33 or later
  • PAN-OS 10.2: 10.2.7-h34 or later
  • Prisma Access 11.2: 11.2.7-h13 or later
• Terminate all active VPN sessions after patching — a forged session active at patch time remains valid until terminated
• Rotate the certificate used to sign authentication override cookies, then re-enable strict HMAC validation if you previously used the CLI workaround

Short Term (Within 7 Days)

• Hunt for the ESXi pivot: Review vCenter access logs for connections from unexpected IP ranges, especially during off-hours. Look for changes to execInstalledOnly and for any VMDK file access from hosts that are not the running guest
• Audit AD for compromise: Run a KRBTGT password reset (or dual-reset) and review privileged account usage since the patch window opened in May 2026. If you cannot rule out prior exploitation, assume your domain has been compromised and act accordingly
• Review your PAN-OS management interface exposure — while CVE-2026-0257 targets the GlobalProtect plane, our recent coverage of CVE-2026-0322 showed that management interfaces of the same appliances are also under active attack. Ensure management access is restricted to out-of-band networks or a dedicated management VLAN with strict ACLs

Strategic (Zero-Trust Posture)

• Do not trust VPN authentication alone as an access-granting event. Implement continuous identity verification and device posture checks post-authentication — the zero-trust principle of “never trust, always verify” is precisely designed for the scenario where the VPN perimeter has been bypassed
• Segment your virtualisation management plane from the network segments reachable by VPN users. In a properly segmented architecture, a compromised VPN session should not have direct Layer-3 access to vCenter or ESXi management interfaces
• Instrument VMDK access: Alert on any process reading raw VMDK files on hosts where the guest OS is live — this is almost never legitimate and is a strong indicator of credential-harvesting activity

Frequently Asked Questions

Is my organisation at risk if we disabled authentication override cookies?

If GlobalProtect authentication override cookies were never enabled, you are not vulnerable to CVE-2026-0257. However, you should still patch to a fixed PAN-OS build, as the advisory covers related hardening. Verify the cookie feature state in your GlobalProtect portal and gateway configuration tabs, not just through memory — misconfigurations in templated deployments are common.

Can the ESXi pivot happen even if we patched in May?

Patching on 1 June (the CISA deadline) means your window of exposure was potentially several weeks. If CVE-2026-0257 was exploitable in your environment during that window, an attacker may have established persistence that survives the patch. The vCenter pivot and offline VMDK credential theft happen after initial access — meaning any undetected sessions from May or June could have led to long-dwell-time compromise that the October patch does not remediate. Threat hunting is mandatory.

Which PAN-OS versions are safe?

Per the official Palo Alto advisory, fixed releases exist across PAN-OS 10.2, 11.1, 11.2, and 12.1. PAN-OS 10.1 and earlier are end-of-life and do not have patches — if you are running end-of-life code, upgrade to a supported branch immediately. Panorama and Cloud NGFW are not affected by this specific CVE.

Does Fortinet equipment face the same risk?

CVE-2026-0257 is specific to Palo Alto Networks PAN-OS GlobalProtect. Fortinet VPN products have their own CVE history — FortiGate SSL-VPN vulnerabilities have been extensively covered on this blog, including the recent PEERSTITCH implant and Gentlemen ransomware campaigns. The technique of abusing authentication override or session-resumption features is a pattern worth examining in any vendor’s VPN implementation. If your FortiGate SSL-VPN is unpatched, treat it with the same urgency.

The Bigger Picture for Indian Enterprises

India’s enterprise sector has invested heavily in Palo Alto Networks’ GlobalProtect for hybrid workforce connectivity — from banking and financial services to IT outsourcing firms and critical infrastructure operators. With CERT-In’s 6-hour mandatory incident reporting requirement now firmly in force, a ransomware deployment that originates from an unpatched VPN gateway carries not just operational risk but regulatory and reputational consequences. The three-gang exploitation of CVE-2026-0257, combined with the ESXi pivot technique, means a single unpatched appliance could trigger a full-organisation crisis requiring mandatory disclosure.

This is also a pointed reminder that perimeter-based security — where “inside the VPN” equals “trusted” — is an outdated model. The VPN bypass leads directly to the credential store. Zero-trust network access (ZTNA), continuous device posture validation, and microsegmentation of the virtualisation plane are no longer aspirational architectures; they are now the minimum bar for enterprise resilience.

---

Is your GlobalProtect deployment patched and threat-hunted? If you are not certain — or if your organisation has been running a vulnerable PAN-OS build since May — contact Sanjay Seth for a rapid security assessment. With 30 years of hands-on network security experience across FortiGate, Palo Alto, and zero-trust deployments, P J Networks can help you determine whether your environment was exposed and what immediate remediation steps are required before the next ransomware group comes knocking.