Why Patching Your VPN Gateway Does Not Evict the Attacker Already Inside

Patch management measures one thing: whether the vulnerable code is still running. For most bugs that is the right question. For an authentication bypassAuthentication Bypass📖A security vulnerability that allows an attacker to circumvent the login verification process and gain unauthorized access to a system without providing valid credentials. on a perimeter device it is only half of it, because the attacker's goal was never to keep exploiting the bug. It was to get a session, and a session does not care what firmwareFirmware🏠Permanent software programmed into a device's hardware that controls its basic functions. the appliance is running now.

The GlobalProtect bypass CVE-2026-0257 makes this concrete. Palo Alto Networks shipped fixes on 13 May 2026. Exploitation began within four days. Qilin affiliates were deploying ransomware through forged VPN sessions in June. By October, ReliaQuest was reporting a second operation, Settra, using the same flaw, and leading its advice with a warning that patching alone may not remove access established before remediation. Every organisation that patched at some point between May and October and considered the matter closed has a question to answer about the interval before the patch.

Two separate jobs

Remediating an exploited authentication bypass has two components that need to be tracked separately.

Closing the door means running a fixed build, or applying a mitigation that removes the vulnerable condition. This is what your vulnerabilityVulnerability🛡️A weakness in software, hardware, or processes that can be exploited by attackers to gain unauthorized access or cause harm. scanner checks and what your patch compliance dashboard reports. It is necessary and it is where most programmes stop.

Evicting the occupant means ending every session, credential and foothold the attacker could have acquired while the door was open. This is not detected by a scanner, is rarely owned by the patching team, and in most organisations is not a step in the runbook at all.

The asymmetry is dangerous because the first job produces a green tick and the second produces nothing visible. A compliance report showing 100 percent of firewalls on a fixed build is true and also tells you nothing about whether an attacker is still connected through one of them.

Why sessions survive the patch

A VPN session, once authenticated, is a stateful object the gateway maintains until it expires or is torn down. Upgrading the appliance may or may not drop existing tunnels depending on the platform and the upgrade path, and a high-availability pair can keep sessions alive through a rolling upgrade by design. A forged session created on 10 May can therefore still be passing traffic on 11 May after the patch.

Worse, the session was only ever the first step. In the Qilin intrusions Arctic Wolf investigated, the actor used the VPN foothold to dump credentials from LSASS, extract the Active Directory database, install AnyDesk, Ngrok, LogMeIn and MeshAgent, and move laterally with PsExec and RDP. Once any of that has happened, the VPN session is disposable. The attacker now has valid domain credentials and three independent remote-access channels, none of which depend on the bypass continuing to work. Patching the firewallFirewall🌐Security system that monitors and controls network traffic based on predetermined rules. at that point changes nothing about the attacker's access.

This is the pattern defenders should internalise: for initial-access vulnerabilities, the vulnerable window is a period of exposure that has to be investigated, not a status that flips to resolved when the patch lands.

What eviction actually requires

For CVE-2026-0257 the vendor and researchers between them describe the full set of steps. Treat it as a template for any similar bug.

Force global re-authentication. Palo Alto Networks' fix requires users to authenticate once after upgrade so the appliance regenerates authentication override cookies under strict HMAC validation; ReliaQuest recommends terminating all active GlobalProtect sessions after patching. The two statements describe the same action from different angles. Every existing session ends, legitimate users log back in, forged sessions cannot.

Rotate the key material the bypass depended on. The advisory's workaround is a certificate used exclusively for authentication override cookies, replacing any certificate that was previously used for other functions. If the bypass abused a shared certificate, the shared certificate has to go, not just be reassigned. How a VPN Authentication Override CookieAuthentication Override Cookie🛡️An encrypted cookie a VPN portal or gateway issues after a successful login so the client can reconnect without re-entering credentials. It acts as a bearer token, so its confidentiality and integrity protection decide whether it can be stolen or forged. Works and Why a Forged One Is a Full Login explains why the certificate matters.

Hunt the window. Review every successful authentication from the advisory date to the moment sessions were terminated. How to Hunt VPN Logs for Sessions That Never Entered a Password gives a method. The output is a list of sessions that are confirmed legitimate, confirmed malicious or unresolved.

Reset what the attacker could have taken. For any confirmed or unresolved session, reset the account's credentials. If there is evidence of domain controller access or LSASS activity, you are no longer remediating a VPN bug; you are in an Active Directory compromise, and the credential reset scope expands to every account whose hash was obtainable, including the KRBTGT account, twice.

Remove the second doors. Search for the remote-access tools and tunnelling agents the campaigns are known to install. An attacker who left MeshAgent on a server does not need your VPN.

Building it into the runbook

The reason this work gets skipped is not that anyone disputes its value. It is that no step in the standard patch process asks for it, and no metric exposes its absence. Three changes fix that.

Classify vulnerabilities by what exploitation yields. Any vulnerability that gives an attacker an authenticated session, a credential or code execution on a perimeter or identity system should carry an "eviction required" flag. CISA's KEV entry for CVE-2026-0257 marks ransomware use as known; that is as clear a signal as you will get that the vulnerable window needs a hunt, not just a patch.

Make session termination a patch step, not a judgement call. For VPN gateways, identity providers, remote-access portals and any system that issues bearer tokens, the change ticket should include "terminate all sessions and force re-authentication" as a mandatory task with its own completion time. Users will complain once. That is the cost of being certain.

Report the window, not just the patch date. For each eviction-required vulnerability, the status report should show three dates: advisory published, fix applied, sessions terminated and hunt completed. The gap between the first and third is your real exposure. If the third column is empty, the vulnerability is open regardless of what the scanner says.

The strategic point

Perimeter appliances are the most attacked class of asset in enterprise IT precisely because a single bypass hands the attacker what months of phishingPhishing🛡️A social engineering attack using fake emails or websites to steal login credentials or personal info. might not: a legitimate-looking connection into the network. The vendors who build those appliances are getting faster at shipping fixes, and CISA's deadlines for federal agencies now run to days rather than weeks. Neither of those improvements helps if the organisation's definition of "fixed" stops at the firmware version.

CVE-2026-0257 was patched in May. Settra was still profiting from it in October. The difference between an organisation that was exposed for four days and one that is still compromised today is not when they patched. It is whether anyone went back and asked who came through the door while it was open.