RANSOMWARE groups are abusing CVE-2026-0257, a GlobalProtect authentication bypass in PAN-OS, to gain VPN access without valid credentials and to bypass MFA safeguards. The exposed flaw lets attackers skip login checks on vulnerable GlobalProtect portals and gateways, enabling it to start a VPN session as if authenticated. CISA added CVE-2026-0257 to its Known Exploited Vulnerabilities list on 13 May 2026, and a public proof-of-concept followed on 29 May, signalling active exploitation.
In observed campaigns, Unit 42 links the intrusions to the Qilin (Spikey Scorpius) and Tarnished Scorpius operators, with ReliaQuest associating Settra ransomware activity to the same vulnerability. The attackers typically enter through the VPN, then map the network using remote management tools, move laterally via RDP and SMB, and prepare credential theft, data exfiltration and ransomware deployment.
In at least one instance, the VPN pivot reached a vCenter appliance, with ESXi security controls disabled and credentials dumped from a domain controller’s virtual disk, described as bypassing in-guest endpoint detection and security controls.
Defence and detection guidance from Unit 42 and ReliaQuest emphasise patching PAN-OS or applying vendor workarounds, terminating all active GlobalProtect sessions after patching, and disabling authentication override cookies where not needed. Additional indicators include VPN sessions with generic device names or placeholder MAC addresses, hostnames such as “kali,” or sessions showing an empty user domain or a Windows 10 Pro OS string.
The analysis also highlights related toolchains such as Cobalt Strike, BloodHound and SharpHound, noting that VPN-origin traffic can resemble normal remote work and may go undetected until credential theft, lateral movement, data exfiltration or ransomware deployment is underway. ReliaQuest attributes the activity to Qilin and Inc, with the Settra link derived from public reporting. Exploitation is expected to continue for several months.