The GlobalProtect vulnerability CVE-2026-0257 is five months old, and on October 19, 2026, it became a ransomware story. Palo Alto Networks’ Unit 42 updated its threat brief that day to say two ransomware groups are trying to exploit it: Qilin and Inc.
If your organization connects to the office through a Palo Alto Networks firewall with GlobalProtect VPN, this one is for you. Many nonprofits and associations have that setup and let a managed services provider (MSP) run it. This piece covers what the flaw is, why it is back in the news, the questions to send your MSP this week, and what to do if the firewall cannot be patched right away.
The short version: ask your MSP three things. What PAN-OS version are we on, and when was it installed? Were our GlobalProtect logs checked for the indicators Unit 42 published? If we are not patched, which workaround is in place? A patch closes the hole. It does not remove anyone who already came through it.
What the GlobalProtect vulnerability does
GlobalProtect is the VPN software built into Palo Alto Networks firewalls. Staff run it on a laptop to reach office systems from home. The firewall side has two parts: a portal, where the laptop gets its settings, and a gateway, where the VPN connection lands.
The Palo Alto Networks advisory, first published May 13, 2026, describes authentication bypass flaws in both. An attacker can skip the sign-in and open a VPN connection without a valid account.
The weak point is a convenience feature called authentication override. After someone signs in, the firewall can hand the laptop a cookie, so the user does not have to sign in again for a while. According to Rapid7’s analysis, the firewall trusted the contents of those cookies without checking that it made them. If the cookie certificate was also used for the portal’s web page, anyone could read the public part of it and forge a cookie for any user.
Rapid7 says this feature is not on by default. If your MSP turned it on, it matters a great deal.
Who is exposed to the GlobalProtect vulnerability
The advisory says a firewall is exposed only if three things are true:
- GlobalProtect is set up. The firewall has a GlobalProtect portal or gateway.
- Cookies are on. Authentication override cookies are enabled on the portal, the gateway or both.
- The certificate setup matches. The advisory calls it “a specific certificate configuration.” Rapid7 describes it as the cookie certificate being reused for another feature, such as the portal’s web page.
Panorama, Palo Alto Networks’ central management tool, is not affected. Neither is Cloud NGFW. Prisma Access, the cloud version, was affected, and Palo Alto Networks says it is upgrading Prisma Access for customers on a schedule it shares with them.
If you do not use GlobalProtect, the GlobalProtect vulnerability does not apply to you. If you are not sure, that is your first question for the MSP.
Why a five-month-old bug is news again
The timeline explains why this is back on your desk.
| Date (2026) | What happened | Source |
|---|---|---|
| May 13 | Palo Alto Networks publishes the advisory and fixes | Vendor advisory |
| May 17 | Earliest exploitation Rapid7 observed | Rapid7 |
| May 29 | Proof-of-concept code released; CISA lists the flaw as known exploited | Unit 42, Rapid7, NVD |
| Early June | Unit 42 investigations begin | Unit 42 |
| October 19 | Unit 42 names ransomware groups exploiting it | Unit 42 |
In May, attacks on the GlobalProtect vulnerability looked limited. Rapid7 saw no sign of attackers moving deeper into networks. In 8 of the 10 affected customers it studied, the firewall accepted the forged cookie but no full VPN session followed.
The October update changes that picture. The Unit 42 threat brief names Spikey Scorpius, also known as Qilin, and Tarnished Scorpius, also known as Inc. Unit 42 also cites public reporting from ReliaQuest that ties the exploitation to a third group, Settra. We have not seen ReliaQuest’s full research, so treat the Settra link as reported.
What the ransomware groups do after they get in
Unit 42 describes a pattern that should worry anyone who runs a small office network. After exploiting the GlobalProtect vulnerability, attackers:
- Get past multi-factor authentication to open a VPN session.
- Look around the network with remote monitoring and management (RMM) tools, the same kind of tools many MSPs use.
- Move between computers using Remote Desktop and Windows file sharing.
- Stage tools to steal passwords, copy data out and launch ransomware.
In one case, attackers went from the VPN gateway to a VMware vCenter server. They turned off security controls on the host servers and pulled passwords from a copy of a domain controller’s disk. That method avoids the antivirus running inside the server.
Unit 42 also reports attackers pairing this flaw with an older Veeam backup flaw, CVE-2023-27532. Backups are what you restore from after ransomware, so that pairing matters. We covered why in our data backup strategy basics.
Unit 42 lists education, healthcare, government and financial services among the sectors targeted. It does not name nonprofits or associations. It does not say how many organizations were hit.
Questions to ask your MSP about the GlobalProtect vulnerability this week
You do not need to read the advisory yourself. You need written answers. Here is a list you can send as written.
- Do we use GlobalProtect VPN on our Palo Alto Networks firewall? Is authentication override (the sign-in cookie) turned on?
- What PAN-OS version is the firewall running today? Is it on the fixed list in the CVE-2026-0257 advisory?
- On what date was that version installed? Was it before or after May 29, when attack code went public?
- Have you searched our GlobalProtect logs for the indicators in Unit 42’s October 19 brief, back to mid-May? Who did it, and what did you find?
- If we are not patched, which workaround is in place, and since when?
- Is our Veeam backup server patched for CVE-2023-27532? Can someone on the VPN reach it, or our vCenter server?
A good MSP answers the first three in one reply. The fourth question is the one that tells you whether they looked. Patch dates matter because a firewall patched in July was open for about two months while attacks were under way.
Which PAN-OS versions fix the GlobalProtect vulnerability
Your MSP should compare your exact version to this list. Each branch has several fixed releases. Any fixed release on your branch, or anything later, is covered.
| PAN-OS branch | Fixed releases (this version or later) | Notes |
|---|---|---|
| 12.1 | 12.1.4-h6, 12.1.7 | Earlier 12.1 releases affected |
| 11.2 | 11.2.4-h17, 11.2.7-h14, 11.2.10-h7, 11.2.12 | Earlier 11.2 releases affected |
| 11.1 | 11.1.4-h33, 11.1.6-h32, 11.1.7-h6, 11.1.10-h25, 11.1.13-h5, 11.1.15 | Earlier 11.1 releases affected |
| 10.2 | 10.2.7-h34, 10.2.10-h36, 10.2.13-h21, 10.2.16-h7, 10.2.18-h6 | Earlier 10.2 releases affected |
| Older, unsupported | None | Move to a supported fixed release |
Source: the Palo Alto Networks advisory, last updated June 3, 2026. Prisma Access 11.2 and 10.2 have their own fixed versions, which Palo Alto Networks applies.
Two upgrade details to pass along. First, every GlobalProtect user has to sign in again once after the upgrade, even with a valid cookie. Tell staff before it happens. Second, the advisory says to upgrade all portals and gateways together if you use the cookies. A mixed setup can break the cookies, and the advisory’s FAQ gives a temporary command for a phased upgrade.
What to do if you cannot patch yet
Sometimes a firewall upgrade has to wait for a maintenance window or a hardware swap. The advisory gives two workarounds for the GlobalProtect vulnerability:
- Turn off the cookies. Disable “Generate cookie for authentication override” and “Accept cookie for authentication override” on the portal and gateway. Our reading: staff will likely be asked to sign in more often.
- Give the cookies their own certificate. Create a new certificate used only for authentication override cookies. The advisory says not to reuse an old one, even after removing it from other services.
Either one should be done the same day you learn you are unpatched. Neither replaces the upgrade.
If your firewall runs an unsupported PAN-OS version, there is no fix for it. That is a hardware and budget conversation to start now.
Federal agencies had a June 1, 2026 deadline to fix this, according to the NVD record of the CISA listing. That deadline does not bind a nonprofit. It does show how urgent CISA considered it.
How your MSP should check the logs
Patching stops new attacks. It does nothing about a session that already happened. That is why the log review is the most important question on the list.
Unit 42 tells defenders to search GlobalProtect logs for:
- Successful logins from a list of attacker IP addresses seen before the May 29 code release.
- Gateway-connected events from any IP address with host IDs aa:bb:cc:dd:ee:ff or 00:11:22:33:44:55, or device names WINDOWS-LAPTOP-001, DESKTOP-GP01 or GP-CLIENT.
- Connections that match the public attack code: an endpoint OS version of Microsoft Windows 10 Pro 64-bit with an empty user domain field.
Rapid7 adds one more check: sign-ins where the authentication method is "Cookie," especially to local accounts such as admin. It also lists the device name Jocker.
If you do not have that plan written down, our guide to why you need a data breach response plan is a place to start.
The bigger lesson for small IT teams
Firewalls and VPNs sit on the open internet, and attackers scan them all day. When a flaw like the GlobalProtect vulnerability lands, the window between the fix and the first attack is short. Here it was four days.
Multi-factor authentication still matters. This case shows it protects the sign-in, and a bypass of the sign-in step skips it. Our posts on what multi-factor authentication does and how a VPN works cover the basics. Our ransomware primer covers what happens next if attackers get in.
This is also not the first authentication flaw in CISA’s catalog that failed open. We covered another in the first MCP flaw in the KEV catalog.
For an organization that pays an MSP, the practical habit is simple. When a firewall or VPN flaw makes the news, ask for the version, the patch date and the log review in writing. Do it every time.
Frequently Asked Questions
What is the GlobalProtect vulnerability CVE-2026-0257?
It is a set of authentication bypass flaws in the GlobalProtect portal and gateway in Palo Alto Networks PAN-OS. An attacker can open a VPN connection without signing in. Palo Alto Networks published fixes on May 13, 2026.
Why is it in the news again in October?
On October 19, 2026, Unit 42 updated its threat brief to name ransomware groups Qilin and Inc as exploiting it. Unit 42 also cites ReliaQuest reporting that ties it to Settra ransomware.
Are we affected if we use Palo Alto Networks firewalls?
Only if the firewall runs GlobalProtect, authentication override cookies are on, and the certificate setup matches the advisory. Panorama and Cloud NGFW are not affected. Ask your MSP to confirm in writing.
Which PAN-OS versions are fixed?
Fixed releases include 12.1.7, 11.2.12, 11.1.15 and 10.2.18-h6, plus several hotfix releases on each branch. The full list is in the advisory and in the table above.
Does patching remove an attacker who already got in?
No. A patch stops new attacks. Your MSP still needs to search the GlobalProtect logs for the indicators Unit 42 and Rapid7 published, going back to mid-May.
What if we cannot patch right away?
Turn off the authentication override cookies, or give them a new certificate used for nothing else. Both are in the advisory. Neither replaces the upgrade.
Will staff notice the upgrade?
Yes, once. The advisory says GlobalProtect users must sign in again after the PAN-OS upgrade, even with a valid cookie. After that, sign-in works as before.
Does multi-factor authentication stop this?
No. Unit 42 says attackers bypassed MFA to open VPN sessions. MFA is still worth having, but it does not protect against the GlobalProtect vulnerability.
Why does Unit 42 mention Veeam?
Unit 42 reports attackers chaining this flaw with CVE-2023-27532, a Veeam backup flaw. Ask your MSP whether your backup server is patched and whether it can be reached from the VPN.
