Ransomware groups are exploiting a high-severity Palo Alto Networks GlobalProtect VPN vulnerability (CVE-2026-0257, CVSS 7.8) to bypass multi-factor authentication and break into corporate networks. Palo Alto’s Unit 42 links the attacks to Qilin and Inc ransomware, in cases since early June across healthcare, finance, government, manufacturing, and other sectors. The first exploitation was seen on May 17, four days after Palo Alto released a fix.
Only portals and gateways with authentication override cookies enabled are exposed, and only when the cookie certificate is also used for a public-facing service. Attackers take the public key from that service and forge a cookie the gateway accepts in place of a full login.
In one standout case, attackers reached VMware’s vCenter management system, disabled an ESXi security control, then pulled credentials directly from a domain controller’s virtual disk — completely sidestepping endpoint detection tools running inside the VM. Unit 42 also saw attackers pair this access with tools targeting Veeam backup systems through a separate known flaw, CVE-2023-27532.
Organizations should patch all affected GlobalProtect portals and gateways immediately; users will need to sign in again once afterward. As a temporary fix, disable authentication override cookies or generate a new certificate used only for them.
Source: Cybersecurity News
