A flaw in a widely used business VPN is letting attackers log in as if they had passed multi-factor authentication (MFA).
They haven't. They have forged the proof the system trusts.
On 19 October, Palo Alto Networks' Unit 42 team updated its threat brief to name two well-known ransomware groups, Qilin and Inc, among those exploiting it.
What happened
The vulnerability is CVE-2026-0257, an authentication bypass in the GlobalProtect portal and gateway on Palo Alto Networks firewalls. According to a Cloud Security Alliance research note, it affects PAN-OS 10.2, 11.1, 11.2 and 12.1, and Prisma Access 10.2 and 11.2.
A device is only exposed if GlobalProtect is configured, the authentication override cookie feature is switched on, and the same certificate is used for the HTTPS interface and for signing those cookies.
Palo Alto published its advisory on 13 May. Rapid7 reports it first saw exploitation on 17 May, about four days later. Unit 42 says its investigations have run since early June, across healthcare, education, financial services, manufacturing, government and energy. Palo Alto rates the flaw High, with a CVSS score of 7.8.
How the attack works, in plain English
Think of the cookie as a wristband handed out once you have proved who you are, so you don't have to queue again. If an attacker can work out how the wristband is made, they can print their own. The gateway accepts it and lets them onto the VPN with no password prompt and no MFA code.
Once inside, Unit 42 says attackers scout the network with remote monitoring and management tools, then move sideways using RDP and SMB. In one case they reached a VMware vCenter appliance, switched off ESXi security controls and copied a domain controller's virtual disk to pull out passwords offline, which sidesteps security software running inside the machine.
They have also combined this with a Veeam flaw, CVE-2023-27532, which can expose stored backup credentials.
What this means for UK small businesses
Most small firms don't run their own Palo Alto set-up, but many rely on an IT provider who does, or use the same VPN for remote staff.
The lesson goes beyond one vendor: MFA protects the login, not the gateway itself. If there is a weakness in the front door, a strong lock on the inside doesn't help.
The route in this story, VPN first, then virtual servers and backups, is popular with ransomware gangs because it reaches the very things you would rely on to recover.
There is no need to panic. Only certain configurations are exposed, and a fix exists. But this is a patch-now story.
What to do this week
Ask the question. Email your IT provider, or whoever manages your firewall: "Do we use Palo Alto GlobalProtect, and is CVE-2026-0257 fixed?" Get the answer in writing.
Patch, or apply the workaround. Palo Alto's advisory lists fixed releases. If patching has to wait, the interim options are to disable authentication override cookies, or to use a dedicated certificate just for signing them.
Check the logs. Ask for a review of GlobalProtect logs for successful gateway-connected events you can't explain, and for the indicators listed in Unit 42's brief.
Limit what a VPN user can reach. Restrict VPN users to the network ranges they actually need, rather than flat access to everything.
Protect your backups. Keep backup and virtual-server admin accounts separate, with their own strong credentials. Make sure at least one backup copy is offline or immutable, and that your backup software is patched.
Sophia Says
"This one is a good reminder that MFA isn't a force field. It's a lock on the front door, and here the attackers found a way through the wall next to it. What worries me most isn't the first login. It's how quickly they head for the virtual servers and the backups."
"At HackRisk, I look at your business the way an attacker would. I can show you which services are visible from the internet and flag known weaknesses on them, so a risky VPN gateway shows up in your report before someone else spots it. I'm not a substitute for patching, but I'll tell you where to look first."
— Sophia, HackRisk AI Security Analyst
Where HackRisk fits
- Recon Scan: shows what an outsider can see of your business, including remote-access gateways.
- Vulnerability Scan: checks internet-facing systems for known weaknesses, so patching goes to the right place first.
- Dark Web Scan: checks whether staff credentials are already for sale, which matters when attackers go hunting for stored passwords.
