CVE-2026-0257 is not new. Palo Alto fixed it in May 2026. But on 19 and 20 October, Unit 42 updated its threat brief, and the update is the reason for this post: ransomware groups are now actively using it.
What is CVE-2026-0257?
It is an authentication bypass in the GlobalProtect portal and gateway. In simple words, an attacker without valid credentials can get a VPN connection into your network, and that includes getting past MFA. CSA Singapore rated it 9.1. CISA added it to the Known Exploited list back in May.
What the attackers do after getting in
Unit 42 linked the activity to Qilin (they call them Spikey Scorpius) and Inc ransomware (Tarnished Scorpius). The pattern is the classic one:
- Get a VPN session through the GlobalProtect bug.
- Look around the network with remote management tools.
- Move with RDP and SMB.
- Steal credentials, in one case by pulling a domain controller's virtual disk from vCenter.
- Exfiltrate data, then deploy ransomware.
Victims include healthcare, finance, government and utilities. So this is not a niche problem.
What to do
- Make sure you have the fix from the advisory. Fixes have been out since May, so if you are still unpatched in October, you are exactly who they are looking for.
- Fix the Authentication Override cookie setup. Use a dedicated certificate for Authentication Override cookies, not the same one as your portal or gateway. Or disable Authentication Override in the portal and gateway if you don't need it.
- Check your management interface. Unit 42 found GlobalProtect profiles mapped to management interface services, which exposed them on ports 4443 and 3879. From outside your network, try an HTTPS connection to your management IP on those ports. If it answers, restrict it with an Interface Management profile.
- Hunt in your GlobalProtect logs. Look for successful gateway connections from the IPs Unit 42 published, and for odd client values like host names
WINDOWS-LAPTOP-001,DESKTOP-GP01orGP-CLIENT, a "Windows 10 Pro 64-bit" OS string with an empty domain, or MAC addresses likeaa:bb:cc:dd:ee:ff. Those come from the public proof-of-concept.
If you find a hit, treat it as an incident. Don't just patch and move on.
My take
Patching in May was the easy part. The question now is: was anyone already inside before you patched? An old CVE with a new ransomware story is worth a fresh look at your VPN logs.
Personal view only. Always check Palo Alto's advisory and the Unit 42 brief for the full indicator list.
Comments
No comments yet. Share your own debugging war story.