PAN-OS GlobalProtect auth bypass (CVE-2026-0257) now used by Qilin and Inc ransomware, plus an exploited management RCE (CVE-2026-0322)

What happened

CVE-2026-0257 is an authentication bypass in the GlobalProtect portal and gateway. It lets an attacker establish a VPN connection without valid credentials. Palo Alto Networks fixed it on 13 May 2026. It only applies when GlobalProtect Authentication Override cookies are enabled, together with a certificate configuration the advisory does not describe (Palo Alto Networks). The CVE record classes it as CWE-565, reliance on cookies without validation (CVE record). CISA added it to the KEV catalog on 29 May 2026 and marks it as known to be used in ransomware campaigns (CISA KEV).

In October, Unit 42 updated its threat brief. On 19 October it added ransomware activity: Spikey Scorpius (Qilin) and Tarnished Scorpius (Inc) are using the bypass for initial access, getting past MFA to open a VPN session. On 20 October it added verification and remediation guidance (Unit 42). After getting in, the actors used remote management tools for reconnaissance, moved over RDP and SMB, pivoted to vCenter, weakened ESXi hosts by disabling execInstalledOnly, and dumped credentials offline from domain controller disks. The actors also followed up with exploit tools against Veeam backup servers (CVE-2023-27532).

CVE-2026-0322 is separate. Published on 14 October 2026, it is a code injection in the PAN-OS management interface that lets an authenticated attacker run code as root. It affects PA-Series and VM-Series firewalls and Panorama. No special configuration is needed. Palo Alto Networks says “very limited exploitation has been observed” and lists no workaround (Palo Alto Networks). CISA added it to KEV the same day (CISA).

Cloud NGFW is not affected by either bug. Prisma Access is affected by CVE-2026-0257 only, and Palo Alto Networks is upgrading it for customers.

Am I affected?

Check the running version from the CLI:

show system info | match sw-version

CVE-2026-0257 fixed builds (Palo Alto Networks):

• 12.1: 12.1.4-h6, or 12.1.7 and later
• 11.2: 11.2.4-h17, 11.2.7-h14, 11.2.10-h7, or 11.2.12 and later
• 11.1: 11.1.4-h33, 11.1.6-h32, 11.1.7-h6, 11.1.10-h25, 11.1.13-h5, or 11.1.15 and later
• 10.2: 10.2.7-h34, 10.2.10-h36, 10.2.13-h21, 10.2.16-h7, or 10.2.18-h6 and later

Is the risky setting on? You are exposed to CVE-2026-0257 only if one of these boxes is checked:

• Portal: Network > GlobalProtect > Portals > [portal] > Agent > [agent config] > Authentication: “Generate cookie for authentication override” or “Accept cookie for authentication override”.
• Gateway: Network > GlobalProtect > Gateways > [gateway] > Agent > [client settings] > Authentication Override: “Accept cookie for authentication override”.

CVE-2026-0322 fixed builds (Palo Alto Networks):

• 12.2: 12.2.4
• 12.1: 12.1.4-h12, 12.1.7-h8, 12.1.10-h2
• 11.2: 11.2.4-h22, 11.2.7-h21, 11.2.10-h15, 11.2.13-h3, 11.2.16
• 11.1: 11.1.4-h37, 11.1.6-h39, 11.1.7-h11, 11.1.10-h35, 11.1.13-h15, 11.1.16-h3
• 10.2: 10.2.7-h38, 10.2.10-h41, 10.2.13-h26, 10.2.16-h11, 10.2.18-h12

Unit 42 also warns that mapping a management profile with HTTP or HTTPS onto a GlobalProtect interface exposes the management interface on ports 4443 and 3879. Test from outside your network whether you can reach the management IP on those ports (Unit 42).

Hunt in GlobalProtect logs (Monitor > Logs > GlobalProtect, or your SIEM) for successful login or gateway-connected events that match any of these (Unit 42):

• Source IPs: 23.128.228[.]6, 104.207.144[.]154, 146.19.216[.]119, 146.19.216[.]120, 146.19.216[.]125, 179.43.172[.]213, 185.195.232[.]139, 198.12.106[.]60, 202.144.192[.]47.
• Host IDs aa:bb:cc:dd:ee:ff or 00:11:22:33:44:55, or device names WINDOWS-LAPTOP-001, DESKTOP-GP01 or GP-CLIENT.
• Proof-of-concept client values: endpoint OS version “Microsoft Windows 10 Pro 64-bit” together with an empty user domain.

What to do now

1. Upgrade to a build fixed for both CVEs. Older unsupported PAN-OS releases must move to a supported fixed version.
2. If you cannot upgrade yet, turn off Authentication Override by clearing the generate and accept cookie options on portals and gateways. If you must keep it, generate a new certificate used only for Authentication Override cookies, not shared with the portal, gateway or anything else (Palo Alto Networks).
3. Lock down the management interface to trusted internal IPs or a jump host, and remove HTTP and HTTPS from interface management profiles on GlobalProtect interfaces. For CVE-2026-0322, Threat IDs 510046 and 510047 (content 9159-10287 and later) give limited coverage, and only with SSL decryption of inbound management traffic (Palo Alto Networks).
4. Treat any log match as an incident. Unit 42 says to activate incident response on a hit. Given the ransomware playbook, check vCenter and ESXi for changed settings (including execInstalledOnly), Veeam servers, and domain controllers for credential theft.

Sources

• Palo Alto Networks: CVE-2026-0257 GlobalProtect authentication bypass
• Palo Alto Networks: CVE-2026-0322 authenticated RCE in the management interface
• Unit 42: threat brief on active exploitation of CVE-2026-0257
• CVE record: CVE-2026-0257
• CISA: adds four known exploited vulnerabilities (14 October 2026)
• CISA KEV entry: CVE-2026-0257