Palo Alto Networks PAN-OS · Exploitation confirmed

PAN-OS CVE-2026-0257 actively exploited by ransomware operators and broker k0t

May 28, 2026 · 1 min read

CVE-2026-0257 is an authentication bypass in PAN-OS GlobalProtect portals and gateways, listed in the CISA KEV catalog since May 13, 2026. Unit 42 reports active exploitation by ransomware operators (Qilin, Inc, and Settra per public reporting), and Group-IB tied initial access broker k0t to the flaw and to over 70,000 exposed credentials. Fixes have existed since May 2026: upgrade PAN-OS or disable authentication override.

By HIFY Radar newsroom Updated 10/26/2026 01:38 PM Get this every day →← Back to the feed 5 sources

CriticalVulnerabilityExploitation confirmedPatched

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

CVE-2026-0257 lets an attacker bypass authentication on Palo Alto firewall GlobalProtect portals and gateways and establish unauthorized VPN connections. The flaw entered the CISA KEV catalog on May 13, 2026 and is actively exploited. Unit 42 reports use by ransomware operators and Group-IB tied initial access broker k0t to the flaw.

Why it matters

Intruders enter the network without credentials, bypass MFA and, according to Unit 42, move on to credential theft, data exfiltration and ransomware. Group-IB says organizations compromised in the k0t campaign later appeared on Qilin and The Gentlemen ransomware leak sites. Companies with exposed Palo Alto firewalls running GlobalProtect with authentication cookies enabled are targets.

What to do

Upgrade PAN-OS today to a fixed release (for example 12.1.7, 11.2.12, 11.1.15 or 10.2.18-h6, depending on the installed version). Meanwhile, disable GlobalProtect authentication override or use a dedicated certificate for the cookies. Review GlobalProtect connection logs for the published indicators.

For the technical team

CVE: CVE-2026-0257
Affected: Palo Alto Networks PAN-OS · PAN-OS 12.1 < 12.1.4-h6 and < 12.1.7; 11.2 < 11.2.4-h17, < 11.2.7-h14, < 11.2.10-h7 and < 11.2.12; 11.1 < 11.1.4-h33, < 11.1.6-h32, < 11.1.7-h6, < 11.1.10-h25, < 11.1.13-h5 and < 11.1.15; 10.2 < 10.2.7-h34, < 10.2.10-h36, < 10.2.13-h21, < 10.2.16-h7 and < 10.2.18-h6; Prisma Access 11.2.0 < 11.2.7-h13 and 10.2.0 < 10.2.10-h36. Panorama and Cloud NGFW are not impacted.
Exploitation: CISA KEV since May 13, 2026; public PoC on May 29, 2026. Palo Alto reports limited exploit attempts on unpatched devices without mitigations. Unit 42 observed active exploitation since June 2026 and on October 19 cited ransomware operators Spikey Scorpius (Qilin) and Tarnished Scorpius (Inc), plus Settra per public reporting. Group-IB (with NyxLab) attributes a CVE-2026-0257-specific tool to broker k0t.
Fix: Upgrade: 12.1 to 12.1.4-h6 or 12.1.7+; 11.2 to 11.2.4-h17+, 11.2.7-h14+, 11.2.10-h7+ or 11.2.12+; 11.1 to 11.1.4-h33+, 11.1.6-h32+, 11.1.7-h6+, 11.1.10-h25+, 11.1.13-h5+ or 11.1.15+; 10.2 to 10.2.7-h34+, 10.2.10-h36+, 10.2.13-h21+, 10.2.16-h7+ or 10.2.18-h6+; Prisma Access to 11.2.7-h13+ or 10.2.10-h36+. Mitigations: a dedicated certificate for authentication override cookies, or disable authentication override. After the upgrade, GlobalProtect users re-authenticate once.
Vector: Authentication bypass (CWE-565, cookies without validation and integrity checking) in the PAN-OS GlobalProtect portal and gateway. Network vector, low complexity, no privileges or user interaction; CVSS 7.8 per Palo Alto. Requires a firewall with a GlobalProtect portal or gateway configured, authentication override cookies enabled and a specific certificate configuration. Group-IB describes a tool that forges the cookie with the public key from the target's TLS certificate and posts an empty password to /ssl-vpn/login.esp.
More details: Vulnerability discovered internally by Palo Alto; advisory published May 13 and updated June 3, 2026. Unit 42 describes post-exploitation: reconnaissance with dual-use RMM tools, lateral movement via RDP and SMB, pivot from the VPN gateway to vCenter, disabling ESXi security controls (execInstalledOnly) and offline credential dumping against a domain controller's VMDK, plus chaining with Veeam CVE-2023-27532. Group-IB (October 21, with NyxLab): k0t selects targets via FOFA and ZoomEye, uses the CVE-2026-0257 PAN-OS GlobalProtect Scanner + VPN Connect tool by developer BeiDou, persists with MeshCentral, AdaptixC2, Atera, Teramind, AnyDesk and ngrok, and exfiltrates with Rclone to Wasabi S3 and MEGA; over 70,000 exposed credentials recovered, with no confirmed link to the ransomware groups. Unit 42 also warns that GlobalProtect profiles mapped to the management interface expose ports 4443 and 3879 (Lunar Peak campaign).