A five-month-old PAN-OS authentication bypass has become routine entry work for ransomware affiliates, and the reason is not exotic exploit code. It is unpatched firewalls attached to internal networks.
CVE-2026-0257 affects the GlobalProtect portal and gateway. An attacker who exploits it establishes a VPN session without ever satisfying multi-factor authentication, then sits on a connection that looks like ordinary remote work.
The rating moved, the exposure did not
Palo Alto Networks disclosed and patched the flaw on May 13, scoring it 7.8 and saying it saw no malicious use. Rapid7 found successful exploitation within days, dating back to at least May 17.
By mid-October, Unit 42 was tracking campaigns from Spikey Scorpius, which it maps to Qilin, and Tarnished Scorpius, its label for Inc. ReliaQuest adds Settra operators and other access brokers to the list.
Post-access behaviour follows a pattern. Operators move with Remote Desktop Protocol and Server Message Block, run Cobalt Strike, BloodHound and SharpHound, harvest credentials, stage data, then encrypt. Targets span education, healthcare, finance, manufacturing, government, legal, logistics and utilities.
The misconfiguration that amplifies everything
During incident response, Unit 42 found organizations routinely map GlobalProtect profiles onto HTTP interfaces on the management plane, exposing administrative ports – 4443 and 3879 especially – to the internet without realizing it.
Because traffic arrives through a legitimate VPN, detection is harder than it looks: the session is already authenticated by the time anyone examines it.
Patch to a fixed PAN-OS build, confirm no management interface answers on those ports, and hunt GlobalProtect logs for successful connections from suspicious hostnames or IPs. A firewall at 7.8 is still a password-free way in.
