GlobalProtect CVE-2026-0257: Settra Joins Qilin, and a Patch Alone Won't Evict Them

Five months after Palo Alto Networks patched an authentication bypassAuthentication Bypass📖A security vulnerability that allows an attacker to circumvent the login verification process and gain unauthorized access to a system without providing valid credentials. in GlobalProtect, the flaw has become shared ransomware tradecraft. ReliaQuest's threat research team reported on 11 October that the Settra extortion operation is now exploiting CVE-2026-0257 alongside Qilin, forging VPN sessions on PAN-OS firewalls and Prisma Access tenants that still accept authentication override cookies. The bigger problem for defenders is the one ReliaQuest put at the centre of its advice: a session created during the vulnerable window survives the patch, so upgrading the firewallFirewall🌐Security system that monitors and controls network traffic based on predetermined rules. does not, on its own, remove the intruder.

What Happened

CVE-2026-0257 is an authentication bypass in the GlobalProtect portal and gateway components of PAN-OS. Palo Alto Networks published the advisory on 13 May 2026 and classifies the weakness as CWE-565, reliance on cookies without validation and integrity checking. The current CVSS v4.0 score is 7.8 (High). Rapid7 notes the advisory originally shipped at 4.7 (Medium) and was raised once exploitation was confirmed, which is worth remembering when a vendor score looks reassuring on day one.

The timeline since then is a textbook n-day arc:

• 13 May: advisory and fixed builds published.
• 17 May: earliest exploitation observed by Rapid7 MDR, with a second wave on 21 May. Both waves used a spoofed MAC addressMAC Address🌐A unique hardware identifier assigned to every network interface. of aa:bb:cc:dd:ee:ff and client hostnames GP-CLIENT and DESKTOP-GP01, suggesting one actor.
• 29 May: CISA added the CVE to the Known Exploited Vulnerabilities catalog with a 1 June due date. The feed now marks ransomware use as "Known".
• June: Arctic Wolf investigated multiple intrusions that began with forged GlobalProtect sessions and ended in Qilin ransomware deployment, published 20 July.
• 11 October: ReliaQuest reports Settra operating alongside Qilin, with Cobalt StrikeCobalt Strike🛡️A commercial adversary-simulation framework whose Beacon implant provides command and control, lateral movement and post-exploitation tooling. Cracked copies are widely used by ransomware operators, so its presence is a strong compromise indicator., BloodHound and SharpHound observed in related activity, and assesses exploitation as highly likely to continue for the next three months.

Palo Alto Networks' own wording remains that it is "aware of limited exploitExploit🛡️Code or technique that takes advantage of a vulnerability to cause unintended behavior, such as gaining unauthorized access. attempts on unpatched PAN-OS devices without mitigations applied." Treat "limited" as a floor, not a ceiling.

Who Is Affected

The flaw is configuration dependent. A PAN-OS firewall is exposed only when a GlobalProtect portal or gateway is configured, authentication override cookies are enabled, and a specific certificate configuration is present. The advisory tells administrators to check two places: the Authentication tab of the portal's Agent configuration under Network, GlobalProtect, Portals, for "Generate cookie for authentication override" or "Accept cookie for authentication override", and the Authentication Override tab of each gateway's Client Settings under Network, GlobalProtect, Gateways.

Panorama and Cloud NGFW are not affected. Affected PAN-OS trains and their fixed builds, per the advisory:

• PAN-OS 12.1: 12.1.4-h6 or 12.1.7 and later.
• PAN-OS 11.2: 11.2.4-h17, 11.2.7-h14, 11.2.10-h7 or 11.2.12 and later.
• PAN-OS 11.1: 11.1.4-h33, 11.1.6-h32, 11.1.7-h6, 11.1.10-h25, 11.1.13-h5 or 11.1.15 and later.
• PAN-OS 10.2: 10.2.7-h34, 10.2.10-h36, 10.2.13-h21, 10.2.16-h7 or 10.2.18-h6 and later.
• Prisma Access: 10.2.10-h36 or 11.2.7-h13 and later, applied by Palo Alto Networks on its upgrade schedule.

Rapid7's analysis of tech support files from compromised customers found a consistent pattern: the Cloud Authentication Service was disabled and authentication override cookies were enabled. If that describes your deployment and you were unpatched at any point since mid-May, assume the gateway was probed.

Technical Analysis

Authentication override is a convenience feature. After a user authenticates once, the portal or gateway issues an encrypted cookie that the GlobalProtect client presents on later connections instead of credentials. Functionally the cookie is a bearer tokenBearer Token🛡️A credential presented in an HTTP Authorization header that grants access to whoever holds it, with no proof of identity beyond possession. Services must validate the token on every request; a code path that accepts any bearer value, as in CVE-2026-59822, is an authentication bypass.: whoever holds a valid one is logged in.

The bug is that the appliance did not adequately validate the integrity of that cookie, which is exactly what CWE-565 describes. The fix adds strict HMAC validation; the advisory notes that after upgrading, users must re-authenticate once so the appliance can regenerate cookies with the stronger method, and documents a CLI command (set global-protect enable-auth-override-cookie-hmac no) to temporarily relax strict validation during a phased rollout until every component is updated. That relaxation should be treated as a short-lived exception with an owner and an expiry.

The certificate condition matters because the cookie is protected by a certificate the administrator chooses. Palo Alto Networks' primary mitigation is to generate a certificate used exclusively for authentication override cookies and never to reuse the portal or gateway certificate for it. If a certificate "was previously utilized for other functions," the vendor says, generate a new one dedicated to this purpose. The implication is that reuse weakens the isolation the cookie depends on; the advisory does not spell out the forgery mechanics further, and we have not seen a public technical write-up that does.

What a forged cookie buys the attacker is what makes this attractive to ransomware crews: a fully authorised VPN session that looks like a remote employee. In the GlobalProtect logs, Rapid7 observed successful gateway-auth and login events with an authentication method of "Cookie", followed by POST requests to /ssl-vpn/hipreport.esp and /ssl-vpn/getconfig.esp, the same endpoints a legitimate client hits. Arctic Wolf's June cases show what follows: sessions from hosts self-identifying as "kali", LSASS memory dumps written with an .odt extension to blend in, NTDS extraction with ntdsutil, PsExec and RDP for lateral movementLateral Movement🛡️Techniques attackers use to move through a network after initial compromise, seeking additional systems to control and data to steal., AnyDesk, Ngrok, LogMeIn and MeshAgent for persistence, Rclone to MEGA for exfiltration with Veeam backup infrastructure singled out, enterprise-wide event log clearing, and a password-gated encryptor named win.exe staged in C:\PerfLogs. ReliaQuest's October indicators add Cobalt Strike and the BloodHound and SharpHound Active Directory mappers, plus four source addresses in the 216.245.184.0/24 range and, again, "kali" hostnames.

Settra itself is new. MOXFIVE tracks its first appearance to June 2026, with roughly two dozen leak-site victims by late that month, a double-extortion model, Tox for negotiations, and a toolset of NetExec, Netscan, Procdump, Mimikatz, PAExec and MeshAgent. Its reliance on compromised VPN access as the entry point makes a credential-free VPN bypass a natural fit. For background on how the cookie itself can stand in for a login, see How a VPN Authentication Override CookieAuthentication Override Cookie🛡️An encrypted cookie a VPN portal or gateway issues after a successful login so the client can reconnect without re-entering credentials. It acts as a bearer token, so its confidentiality and integrity protection decide whether it can be stolen or forged. Works and Why a Forged One Is a Full Login.

Immediate Actions

1. Confirm exposure. Check the portal and gateway settings above. If authentication override is off, or you are on Panorama or Cloud NGFW only, you are not in scope for the bypass, though the hunting steps below still apply if you ran GlobalProtect unpatched.
2. Upgrade to a fixed build for your train, or apply the Prisma Access guidance. If you cannot upgrade immediately, either disable both authentication override options or move the feature to a freshly generated, dedicated certificate.
3. Terminate every active GlobalProtect session once the fix is in. ReliaQuest's core point is that patching alone may not remove access established before remediation. Forcing all users to re-authenticate is also required by the fix itself.
4. Hunt the window. Pull GlobalProtect logs back to 13 May and look for cookie-method logins from hosting-provider ranges, from clients named kali, GP-CLIENT or DESKTOP-GP01, or carrying the aa:bb:cc:dd:ee:ff MAC, and for one source cycling through several internal VPN addresses. How to Hunt VPN Logs for Sessions That Never Entered a Password walks through that method.
5. Follow any hit inward. A forged VPN session is initial access, not the objective. Check domain controllers for ntdsutil and LSASS access, look for Event ID 1102 log-clear events, and review backup servers for unexpected logons; How to Spot DCSyncDCSync🛡️A credential-theft technique in which an attacker impersonates a domain controller and asks a real one to replicate account data, including password hashes, over the normal Active Directory replication protocol. and Mailbox Harvesting After a Web Server Is Breached covers the Active Directory side of that search.
6. Preserve evidence before you upgrade if you suspect compromise. How to Preserve Forensic Evidence on a Network Appliance Before You Patch It explains why the tech support file and logs should be exported first.

Long-Term Outlook

Two patterns here will outlast this CVE. First, the bypass has moved from one Qilin affiliate set to at least two operations, which is the point at which an exploit stops being a campaign and becomes a commodity. ReliaQuest's three-month forecast reflects that: initial access brokers can sell forged VPN sessions to whichever crew pays.

Second, remediation of an authentication bypass has two halves. The patch closes the door; evicting whoever walked through it in the preceding five months is separate work that most patch dashboards never track. Why Patching Your VPN Gateway Does Not Evict the Attacker Already Inside makes the case for building session termination, certificate rotation and a vulnerable-window hunt into every perimeter patch, not just this one.

Sources

• Palo Alto Networks Security Advisory, CVE-2026-0257 PAN-OS: GlobalProtect Authentication Bypass Vulnerabilities: https://security.paloaltonetworks.com/CVE-2026-0257
• CISA Known Exploited Vulnerabilities feed (catalog 2026.10.08, entry for CVE-2026-0257): https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
• Rapid7, Rapid7 Observed Exploitation of PAN-OS GlobalProtect Authentication Bypass VulnerabilityVulnerability🛡️A weakness in software, hardware, or processes that can be exploited by attackers to gain unauthorized access or cause harm. (CVE-2026-0257), 29 May 2026: https://www.rapid7.com/blog/post/etr-rapid7-observed-exploitation-of-pan-os-globalprotect-authentication-bypass-vulnerability-cve-2026-0257/
• Arctic Wolf Labs, Cookie Crumbles: How Exploitation of CVE-2026-0257 Leads to Qilin Ransomware, 20 July 2026: https://arcticwolf.com/resources/blog/exploitation-of-cve-2026-0257-leads-to-qilin-ransomware/
• Infosecurity Magazine, Old Palo Alto VPN Vulnerability Remains a Target for Ransomware Groups, 12 October 2026: https://www.infosecurity-magazine.com/news/palo-alto-vpn-vulnerability-target/
• Cyber Security News, Ransomware Actors Exploiting Palo Alto GlobalProtect Flaw for Stealthy VPN Access, 11 October 2026: https://cybersecuritynews.com/palo-alto-globalprotect-flaw-vpn-access/
• GBHackers, Ransomware Hackers Exploit Palo Alto Networks GlobalProtect VPN Authentication Bypass Vulnerability (ReliaQuest indicators): https://gbhackers.com/ransomware-hackers-exploit-palo-alto-networks-globalprotect/
• MOXFIVE, Settra Ransomware: TTPs, Victims, and Defense Guide: https://www.moxfive.com/blog/settra-ransomware-ttps-victims-and-defense-guide