CVE-2026-0257: 167K Palo Alto GlobalProtect Instances Exposed to Qilin Ransomware

CVE-2026-0257 is a flaw in PAN-OS GlobalProtect's authentication override feature, a mechanism designed to let users authenticate once at the portal and carry that authentication to the gateway via an encrypted cookie, avoiding a second login prompt.

In vulnerable configurations, the portal encrypts the override cookie using the same X.509 certificate it presents on its public HTTPS interface. Because the public certificate is available to any host that connects to the portal, an attacker can retrieve it without credentials. The attacker then constructs a cookie containing a valid session identity, encrypts it with the extracted public key, and presents it to any GlobalProtect gateway in the environment.

The gateway decrypts the cookie and trusts its content without verifying an HMAC signature or checking whether the cookie was legitimately issued by the portal. The session is granted. From the network's perspective, the connection looks identical to a legitimate remote-access session.

The root cause is classified as CWE-565 (Reliance on Cookies without Validation and Integrity Checking). Palo Alto Networks rated the CVSS base score 7.8 High; NIST assessed it at 9.1 Critical based on the AV:N/AC:L/PR:N/UI:N vector, meaning the attack requires no authentication, no special privileges, no user interaction, and works over the network.

The patch released May 13, 2026 adds HMAC signing to override cookies so the gateway can verify the portal issued them. After patching, administrators must explicitly enable this protection using the enable-auth-override-cookie-hmac setting. Without that step, the signed-but-not-enforced configuration leaves gateways partially exposed.

Security researchers tracking internet-facing GlobalProtect deployments found more than 167,000 instances still publicly reachable as of October 2026, with some assessments placing the number closer to 172,000. Not every exposed instance is vulnerable: the flaw requires authentication override cookies to be enabled with a certificate configuration that reuses the portal's public HTTPS certificate. But even a small percentage of the 167,000 represents tens of thousands of potential entry points.

For context, Fortinet's FortiBleed credential campaign reached 86,644 confirmed compromised devices before the FBI issued its advisory. CVE-2026-0257 offers a lower-effort attack path because it requires no prior credentials and no offline cracking: one HTTPS connection and a forged cookie are all it takes.

The sector spread of confirmed Qilin and Settra victims includes technology companies, financial services firms, healthcare organizations, and manufacturing plants. ReliaQuest assessed that exploitation is highly likely to continue for at least three more months based on the volume of exposed instances and the operational tempo of the two groups.

Organizations that patched immediately after the May 2026 release but did not run the HMAC re-enable command are also at partial risk. The patch ships with HMAC validation available but not enforced; without running enable-auth-override-cookie-hmac on every portal and gateway, cookies from pre-patch sessions may still be accepted by updated gateways. Patch verification must include confirming that HMAC enforcement is active, not just that the firmware version is current.

Qilin is an established ransomware-as-a-service operation running since 2022 that targets organizations across healthcare, education, technology, and critical infrastructure with double-extortion attacks: encrypt files and exfiltrate data before demanding payment, then threaten public release of stolen records. Qilin affiliates have hit multiple healthcare providers and law firms in 2026.

Settra is a newer ransomware group that emerged in mid-2026. ReliaQuest identified it as a second actor exploiting CVE-2026-0257 in their October 9, 2026 warning, though Settra's full operational profile is still being characterized by threat intelligence analysts.

Both groups follow the same post-exploitation playbook after entering through GlobalProtect: Cobalt Strike for command-and-control and lateral movement staging, BloodHound for visual mapping of Active Directory trust relationships, and SharpHound for automated AD object collection. Arctic Wolf's June 2026 investigation of Qilin intrusions linked to earlier GlobalProtect exploitation documented credential harvesting, traversal of Windows administrative shares, and systematic log clearing before ransomware detonation.

ReliaQuest specifically flagged that operators connected from hostnames including "kali," confirming the use of a Kali Linux attack platform. This is a detection artifact: any VPN session log showing the hostname "kali" or a hostname consistent with offensive security tooling is a high-confidence indicator of attacker presence, not a penetration tester unless a test is formally scheduled.

The campaign demonstrates why perimeter patches cannot wait for standard maintenance windows. A previous Ivanti zero-day campaign showed the same pattern: attackers begin exploitation within days of a vulnerability becoming known and continue for months as long as unpatched instances remain reachable.

ReliaQuest's October 9, 2026 threat alert published three IP addresses directly tied to Qilin ransomware infrastructure observed during active CVE-2026-0257 exploitation. Block these at your perimeter firewall and review your GlobalProtect logs for any session events associated with them.

Beyond the confirmed IPs, the post-exploitation tooling leaves process-level artifacts that EDR and SIEM platforms can detect. BloodHound.exe and SharpHound.exe have distinct process names and command-line patterns, particularly the use of -c All or --CollectionMethods All to enumerate every AD object type in a single sweep. Cobalt Strike beacons frequently appear as unusual parent-child process relationships: a service process or a document viewer spawning cmd.exe or powershell.exe without a user-visible trigger.

Any VPN session showing a connecting hostname of "kali" or a common offensive-tooling hostname ("parrot," "pentest-vm," "attacker") warrants immediate investigation. These names appear in GlobalProtect gateway logs when the connecting device has not been renamed to match corporate naming conventions.

If you find evidence of exploitation prior to patching, assume the attacker established persistence beyond the VPN session. Cobalt Strike beacons persist across reboots via scheduled tasks and registry run keys. SharpHound collection data is typically exfiltrated to an attacker-controlled host before lateral movement begins. Treat any host that connected to an internal resource from a compromised VPN session as potentially compromised and investigate accordingly.

These rules detect network connections to confirmed Qilin attacker infrastructure and the BloodHound and SharpHound post-exploitation activity observed in CVE-2026-0257 campaigns. Both carry experimental status; validate against your environment's log format before enabling automatic blocking.

Patching CVE-2026-0257 requires two steps: upgrading the PAN-OS firmware to a fixed build AND enabling HMAC validation afterward. Organizations that applied the firmware update without running the HMAC enable command remain partially exposed.

The Qilin and Settra exploitation of CVE-2026-0257 five months after a patch was available is a textbook example of the perimeter vulnerability lifecycle that defenders most need to break: a flaw is disclosed, patches ship, a subset of organizations apply them quickly, and a large unpatched tail remains reachable indefinitely. Ransomware operators specifically target this tail because it provides higher-value, lower-resistance targets whose teams assume they are protected.

The specific risk with VPN authentication bypasses is that the attacker's initial access is invisible in traditional authentication logs. There is no failed login, no brute-force alert, no unusual account. The session looks identical to a legitimate employee's remote access. Detection depends entirely on behavioral analytics: anomalous hostnames, post-exploitation tooling execution, and lateral movement patterns after the VPN session is established.

For organizations running Palo Alto Networks firewalls, this campaign also highlights that patching alone is not sufficient when the fix requires a separate configuration step. The HMAC enforcement command must be run explicitly. Security teams reviewing patch compliance should add that configuration verification to their validation checklist, not just the firmware version check.

Finally, the persistence of exploitation 149 days after patching reflects a broader truth about ransomware economics: the operators who compromise your network via GlobalProtect today are not necessarily the ones who encrypt your files. Qilin and Settra may sell access to downstream affiliates or hold it for deployment at maximum leverage. Treat any confirmed CVE-2026-0257 exploitation as a ransomware precursor requiring immediate containment, not just an authentication event to log.