A vulnerability in Palo Alto Networks' GlobalProtect VPN software is giving ransomware crews a direct route into corporate networks, letting them skip multi-factor authentication altogether. Unit 42, the company's threat intelligence arm, disclosed the activity in an October 19 update, tying exploitation to groups tracked as Spikey Scorpius, also known as Qilin, and Tarnished Scorpius, also known as Inc. Separate reporting has also linked the flaw to operators deploying Settra ransomware.

How the bypass actually works

The vulnerability, cataloged as CVE-2026-0257, centers on a convenience feature called authentication override cookies. These cookies exist so that users who have already logged in once do not need to repeat the full authentication sequence, including MFA, every time they reconnect. According to technical analysis from Rapid7, the problem is that vulnerable GlobalProtect devices decrypt these cookies without properly confirming that a trusted system actually issued them. If the certificate used to sign the cookie is reused elsewhere on a public-facing service, an attacker can retrieve its public key and forge a valid-looking cookie. The gateway then treats that forged cookie as proof of prior login, opening a VPN tunnel without demanding credentials or a second factor. Palo Alto Networks rates the flaw as High severity, with a CVSS score of 7.8, and has assigned it the company's highest response priority. The issue affects certain PAN-OS and Prisma Access deployments of GlobalProtect portals and gateways where override cookies are enabled alongside a susceptible certificate configuration. Panorama and Cloud NGFW are not affected.

From VPN access to a stolen domain controller

Unit 42's investigations, running since early June, span healthcare, education, financial services, manufacturing, government, and energy organizations. Once inside, attackers typically deploy remote monitoring and management tools to map the internal network, then move laterally using Remote Desktop Protocol and Server Message Block before setting up credential theft and data exfiltration ahead of a ransomware deployment. The most striking case documented by Unit 42 saw attackers pivot from the compromised VPN gateway straight to VMware's vCenter management appliance. From there, they disabled the execInstalledOnly security control on ESXi hosts and used a custom tool to pull credentials offline directly from a domain controller's virtual disk file. That technique sidesteps any endpoint detection software running inside the virtual machine entirely, because the attack targets the storage layer beneath the operating system rather than anything executing within it. Unit 42 also found the same intrusion sets pairing this access method with tools aimed at Veeam backup infrastructure through a separate, previously known flaw, CVE-2023-27532, which can expose encrypted credentials stored in backup configuration databases.

What defenders should check now

Because many exploitation attempts never complete a full VPN session, security teams are advised to focus on GlobalProtect logs showing successful gateway-connected events tied to unusual sources or client identifiers, rather than relying solely on failed-login signals. Reported indicators include the IP addresses 104.207.144[.]154 and 146.19.216[.]125, device names GP-CLIENT and DESKTOP-GP01, and host identifiers aa:bb:cc:dd:ee:ff and 00:11:22:33:44:55.

• Apply the Palo Alto Networks advisory and patch every affected GlobalProtect portal and gateway without delay.
• Where patching cannot happen immediately, disable authentication override cookies as a stopgap.
• Alternatively, generate a dedicated certificate used exclusively for override cookies, separate from any certificate shared with public-facing services.
• Review virtualization infrastructure, including vCenter and ESXi configurations, for unauthorized changes to security controls such as execInstalledOnly.

The case underscores a broader shift in ransomware practice: attackers are increasingly bypassing the operating system altogether, going after the hypervisor and storage layers where traditional endpoint defenses have no visibility. For organizations that have treated MFA as a near-absolute safeguard against remote access abuse, this flaw is a reminder that convenience features built to smooth the user experience can just as easily become the weakest link in the chain.