---
title: Qilin and Inc Abuse Palo Alto VPN Flaw to Skip MFA and Raid VMware
description: Ransomware gangs are forging login cookies on unpatched Palo Alto GlobalProtect gateways to skip multifactor checks and break into networks.
canonical_url: https://codekeeper.co/ticker/ransomware-exploits-palo-alto-vpn-vulnerability
---

[Cyberattacks](https://codekeeper.co/ticker/tag/cyberattacks) | [Ransomware](https://codekeeper.co/ticker/tag/ransomware)

# Qilin and Inc Abuse Palo Alto VPN Flaw to Skip MFA and Raid VMware

Ransomware gangs are forging login cookies on unpatched Palo Alto GlobalProtect gateways to skip multifactor checks and break into networks.

![Content Team](https://codekeeper.co/hubfs/_sized/Codekeeper_21_beeldmerkL-800.png)

By Content Team Oct 21, 2026

Share [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fransomware-exploits-palo-alto-vpn-vulnerability%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fransomware-exploits-palo-alto-vpn-vulnerability%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fransomware-exploits-palo-alto-vpn-vulnerability%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fransomware-exploits-palo-alto-vpn-vulnerability%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fransomware-exploits-palo-alto-vpn-vulnerability%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fransomware-exploits-palo-alto-vpn-vulnerability%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

ON THIS PAGE

### Want more insights like this?

Subscribe to our newsletter to get the latest software protection strategies delivered to your inbox.

By submitting your email, you consent to Codekeeper contacting you and agree to our [privacy policy](https://codekeeper.co/privacy-policy) .

Ransomware groups are exploiting a high-severity Palo Alto Networks GlobalProtect VPN vulnerability (CVE-2026-0257, CVSS 7.8) to bypass multi-factor authentication and break into corporate networks. Palo Alto’s Unit 42 links the attacks to Qilin and Inc ransomware, in cases since early June across healthcare, finance, government, manufacturing, and other sectors. The first exploitation was seen on May 17, four days after Palo Alto released a fix. Only portals and gateways with authentication override cookies enabled are exposed, and only when the cookie certificate is also used for a public-facing service. Attackers take the public key from that service and forge a cookie the gateway accepts in place of a full login. In one standout case, attackers reached VMware’s vCenter management system, disabled an ESXi security control, then pulled credentials directly from a domain controller’s virtual disk — completely sidestepping endpoint detection tools running inside the VM. Unit 42 also saw attackers pair this access with tools targeting Veeam backup systems through a separate known flaw, CVE-2023-27532. Organizations should patch all affected GlobalProtect portals and gateways immediately; users will need to sign in again once afterward. As a temporary fix, disable authentication override cookies or generate a new certificate used only for them. Source: [Cybersecurity News](https://cybersecuritynews.com/palo-alto-vpn-flaw-exploited/)

Share this article [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fransomware-exploits-palo-alto-vpn-vulnerability%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fransomware-exploits-palo-alto-vpn-vulnerability%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fransomware-exploits-palo-alto-vpn-vulnerability%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fransomware-exploits-palo-alto-vpn-vulnerability%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fransomware-exploits-palo-alto-vpn-vulnerability%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fransomware-exploits-palo-alto-vpn-vulnerability%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

![blog_book_a_demo_cta_3x](https://codekeeper.co/hubfs/_sized/Codekeeper%202025/blog_book_a_demo_cta_3x-768x512.webp)

Have questions about protecting your software?

Our escrow experts are standing by to help.

[Book a free demo](https://codekeeper.co/book-a-demo)

YOU MAY ALSO LIKE

[Vulnerabilities Critical GitLab Flaw Actively Exploited to Steal Server Secrets Sep 24, 2026](https://codekeeper.co/ticker/gitlab-vulnerability-cve-2026-85706-exploitation)

[CenterPoint Energy Data Breach Hits Over 1 Million Texans Oct 16, 2026](https://codekeeper.co/ticker/centerpoint-energy-data-breach-texas-residents)

[CISA Flagged Six Microsoft Zero-Days as Actively Exploited Back in February — Check You've Patched Aug 11, 2026](https://codekeeper.co/ticker/cisa-adds-microsoft-zero-day-flaws-to-kev-catalog)

[Ransomware New 'SynkLoader' Malware Could Be Paving the Way for Ransomware Attacks Aug 25, 2026](https://codekeeper.co/ticker/synkloader-malware-phishlocker-sso-breach)