GlobalProtect CVE-2026-0257: patching does not end the session

GlobalProtect CVE-2026-0257 is still a ransomware door, five months after the fix. On October 11, ReliaQuest said several ransomware groups, including Qilin and a newer operation called Settra, use the Palo Alto Networks VPN flaw to get into networks, and that the exploitation is "highly likely to continue over the next three months," per Cyber Security News. Palo Alto published the patch on May 13. If your firewall got the update but nobody ended the VPN sessions or looked at what came in before it, you may have patched a door that someone already walked through.

What actually happened

The Palo Alto advisory describes an authentication bypass in the GlobalProtect portal and gateway on PAN-OS 10.2, 11.1, 11.2 and 12.1, plus Prisma Access. It is rated high (CVSS 7.8). An attacker can forge an authentication override cookie and get a VPN session without a password. Two conditions must be true: authentication override cookies are on, and the certificate that signs them is shared with another service. Panorama and Cloud NGFW are not affected.

In July, Arctic Wolf Labs documented the attack chain from real incidents:

1. A forged VPN session, often from a machine with the hostname "kali."
2. Persistence through AnyDesk, Ngrok, LogMeIn and MeshAgent.
3. Credential theft: an LSASS dump and a copy of the Active Directory database (NTDS.dit).
4. Lateral movement with PsExec and RDP, with logs cleared on the way.
5. Data sent to MEGA, Veeam backups targeted, then Qilin deployed across the domain.

ReliaQuest's new point is the one most teams miss: a patch does not remove access that an attacker already has. A stolen domain password still works after the firmware upgrade.

Why it matters for your business

Plenty of small businesses run a Palo Alto box because an MSP installed it years ago. The MSP applied the patch. Did anyone also do the other steps?

What we would do this week:

• Confirm the build. Check PAN-OS against the fixed versions in the advisory. Prisma Access customers: confirm with Palo Alto that your tenant is on 10.2.10-h36 or 11.2.7-h13 or later.
• Fix the config, too. Use a dedicated certificate for override cookies, or turn authentication override off.
• End every active GlobalProtect session. Palo Alto says users must sign in again after the upgrade. Make sure that happened.
• Hunt the logs since May. Look for VPN logins from hosting or VPS IP ranges, "kali" or default DESKTOP- hostnames, and remote tools you did not install.
• If you find something, assume domain compromise. Rotate admin and service passwords, and reset the KRBTGT account twice.

Sources: Palo Alto Networks advisory, Arctic Wolf Labs, Cyber Security News, ReliaQuest on X.