GajShield Threat Advisory — PAN-OS GlobalProtect Authentication Bypass Exploited by Ransomware Groups (CVE-2026-0257)

Severity: Critical | Priority: 1

CVE-2026-0257 is an authentication bypass in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS and Prisma Access. It is rated CVSS 7.8. It lets attackers set up VPN sessions without valid credentials, bypassing multi-factor authentication. Palo Alto Networks patched it in May 2026, and CISA added it to its Known Exploited Vulnerabilities catalog on May 13, 2026.

Unit 42 has since seen the Qilin and INC ransomware groups use it for initial access. After connecting, the attackers:

• run internal reconnaissance with remote management tools
• move laterally over RDP and SMB
• stage credential-theft, data-exfiltration and ransomware tools

In one case, the attackers moved from the VPN gateway to vCenter, disabled protections on ESXi hosts, and dumped domain credentials from a domain controller’s virtual disk, which avoided the endpoint security inside the server. They have also chained this access with a Veeam backup flaw, CVE-2023-27532.

If an alert is raised, one of the addresses Unit 42 linked to exploitation has reached your GlobalProtect portal or gateway. Check your GlobalProtect logs for successful “gateway-connected” events from that address. Also look for connections from any address using these values:

• the host IDs aa:bb:cc:dd:ee:ff or 00:11:22:33:44:55
• the device names WINDOWS-LAPTOP-001, DESKTOP-GP01 or GP-CLIENT
• the OS version string “Microsoft Windows 10 Pro 64-bit” combined with an empty user domain

If you find a successful session, treat it as a network intrusion and start incident response. Then:

1. End the session, and identify the internal address it was assigned and everything that address connected to.
2. Hunt for remote management tools, RDP and SMB activity from VPN address ranges, and new accounts.
3. Check vCenter and ESXi for logins and configuration changes, including the execInstalledOnly setting.
4. Check Veeam servers for unauthorised access.
5. Reset domain administrator, service account and krbtgt credentials. Attackers who reach a domain controller’s disk can take every password hash in the domain.

Whether or not you see alerts:

• Upgrade PAN-OS and Prisma Access to a fixed version listed in Palo Alto Networks’ advisory, or apply its workarounds.
• Review GlobalProtect logs back to May 2026 using the indicators above.
• Make sure vCenter, ESXi and backup servers can’t be reached directly from VPN address ranges.
• Keep backups offline or immutable so ransomware operators can’t delete them.