Ransomware Groups Exploit Patched Palo Alto GlobalProtect Flaw to Bypass MFA

Overview

• Palo Alto patched CVE-2026-0257 on May 13, 2026 and CISA added it to its Known Exploited Vulnerabilities list, but Unit 42 and other vendors reported on October 19 that exploitation by ransomware operators is ongoing.
• The flaw stems from GlobalProtect and Prisma Access accepting authentication cookies without full validation, which allows an attacker to establish an unauthorized VPN session that can bypass multi-factor authentication.
• After gaining VPN access, attackers use legitimate remote management tools and move laterally over RDP and SMB to reach vCenter and ESXi, where they disable hypervisor protections and perform offline credential dumping from virtual machine disks (VMDKs).
• Security firms have linked the activity to multiple ransomware groups including Qilin (Spikey Scorpius), INC (Tarnished Scorpius) and Settra, and said operators have chained the VPN access with other exploits such as those against Veeam backup systems to increase impact.
• Vendors urge immediate patching, termination of active GlobalProtect sessions, credential rotation and proactive threat hunting because applying fixes alone may not remove attackers who established access before remediation and who can mimic legitimate remote users.