Ransomware groups are getting in through GlobalProtect VPNs. On October 19, 2026, Palo Alto Networks' Unit 42 said the Qilin and Inc ransomware groups are exploiting CVE-2026-0257, a flaw in the GlobalProtect VPN on Palo Alto firewalls, to open VPN sessions without valid logins and get past multi-factor authentication. Two days later, Group-IB tied an access broker that feeds ransomware groups to more GlobalProtect break-ins. If you use GlobalProtect, patch it and check it now.
Current as of November 1, 2026. Sources: Unit 42's threat brief, the Palo Alto Networks advisory, Group-IB and NyxLab's k0t research, CISA's Known Exploited Vulnerabilities catalog, The Hacker News, SecurityWeek on Cisco, and SecurityOnline on Ivanti.
Key takeaways
- Patch GlobalProtect now. Palo Alto released fixes for CVE-2026-0257 on May 13, 2026, and CISA has listed it as exploited since May. Unpatched firewalls are now being used for ransomware attacks.
- MFA alone does not stop this flaw. Unit 42 says attackers are getting past multi-factor authentication on unpatched gateways.
- Patching does not undo a break-in. If a firewall was exposed before you patched, check it for unfamiliar VPN sessions, accounts, and changes.
- Other firewalls are targets too. The same access broker hits other firewall brands, often just by guessing common admin passwords, and CISA has listed 24 more exploited firewall and VPN flaws since July, including in Fortinet, SonicWall, Cisco, Ivanti, and Citrix products.
- Palo Alto has a second problem. Separately from GlobalProtect, attackers are using the PHP2Shell flaws to take over PAN-OS firewalls whose management page is exposed to the internet. See our PHP2Shell post.
- Watch for tools you did not install. After getting in, attackers installed remote access software and copied data to cloud storage before deploying ransomware.
Timeline
| Date (2026) | What happened |
|---|---|
| May 13 | Palo Alto Networks publishes fixes and an advisory for CVE-2026-0257. |
| May 29 | CISA adds CVE-2026-0257 to its Known Exploited Vulnerabilities list. |
| June 5 | Unit 42 reports active exploitation. Its incident responders investigate intrusions that start with the flaw from early June on. |
| October 19 | Unit 42 names the Qilin and Inc ransomware groups as operators exploiting CVE-2026-0257. |
| October 20 | Unit 42 adds guidance for checking exposure and fixing it. |
| October 21 | Group-IB and NyxLab publish research on k0t, an access broker exploiting CVE-2026-0257 and other firewall flaws. |
| October 28 | In a separate threat, Palo Alto confirms PHP2Shell attacks on internet-exposed PAN-OS management pages. |
What is CVE-2026-0257?
CVE-2026-0257 is a flaw in GlobalProtect, the remote access VPN built into Palo Alto Networks firewalls. It lets an attacker get past the login and set up a VPN connection to your network. Palo Alto rates it high severity (CVSS 7.8) and gives it its highest patching urgency.
Not every GlobalProtect firewall is exposed. According to the advisory, the flaw affects portals and gateways that use authentication override cookies, a convenience setting that lets users reconnect without signing in again, together with a specific certificate setup. Unit 42 says attackers are using the flaw to get past multi-factor authentication (MFA) and open VPN sessions.
Fixed PAN-OS versions
| PAN-OS release | Update to |
|---|---|
| 12.1 | 12.1.7 or later (or 12.1.4-h6) |
| 11.2 | 11.2.12 or later, or the hotfix for your 11.2 release |
| 11.1 | 11.1.15 or later, or the hotfix for your 11.1 release |
| 10.2 | 10.2.18-h6 or later, or the hotfix for your 10.2 release |
| Older releases | No fix. Upgrade to a supported fixed release. |
Palo Alto is upgrading Prisma Access customers on its own schedule, and Cloud NGFW is not affected. After the fix, every GlobalProtect user has to sign in once more, so warn your team before you update.
What happens after attackers get in
A VPN session puts the attacker on your internal network as if they were an employee working from home. In the intrusions Unit 42 investigated, attackers then:
- Explored the network with legitimate remote management tools, so their activity blended in.
- Moved between computers using Remote Desktop and Windows file sharing.
- Stole passwords, copied data out, and deployed ransomware.
- In one case, reached the virtualization system that runs the company's servers, turned off its security controls, and copied the domain controller's disk to steal every password offline, out of sight of the security software on the servers.
- Combined VPN access with an older flaw in Veeam backup software (CVE-2023-27532), going after the backups a business would need to recover.
Who is k0t?
k0t is the name Group-IB uses for the likely main operator behind a long-running campaign against firewalls and VPN gateways. Group-IB and NyxLab assess that k0t works as an initial access broker: a criminal who breaks into networks and sells or hands that access to ransomware groups. Many of the victims later appeared on the leak sites of the Qilin and The Gentlemen ransomware groups, though the researchers say that relationship is not confirmed.
According to Group-IB's report, k0t:
- Searches the internet for exposed firewalls and VPN gateways, including Palo Alto GlobalProtect and Fortinet devices.
- Exploits known flaws, including CVE-2026-0257 in GlobalProtect and CVE-2025-64446 in Fortinet FortiWeb.
- Falls back to guessing admin passwords from a list of common ones, such as "admin".
- Decrypts passwords saved in older Fortinet configurations that still use the built-in default encryption key.
- Stays in the network through VPN connections and remote access tools such as AnyDesk and MeshCentral, then copies data to cloud storage services Wasabi and MEGA.
The researchers found more than 70,000 exposed credentials, including network device logins and copies of company directory data. Victims are spread worldwide, with the largest shares in Asia Pacific and Latin America, but Group-IB notes that k0t's stated priorities start with the United States and Canada. Many of the older break-ins happened in the first half of 2026, during the FortiBleed campaign, but Group-IB found only a negligible overlap with that data. Group-IB also saw k0t searching for SonicWall SMA1000 remote access appliances, though it found no sign of a successful break-in. The Hacker News has a summary of the findings.
Which other firewalls and VPNs are being exploited in 2026?
GlobalProtect is not the only remote access product under attack. Since July 2026, CISA has added 24 other firewall, VPN, and remote access flaws to its Known Exploited Vulnerabilities list, from Fortinet, SonicWall, Cisco, Citrix, Check Point, Ivanti, F5, and Palo Alto itself. CISA says three of them, two in SonicWall SMA1000 and one in Cisco Secure Firewall Management Center, have been used in ransomware attacks.
| Product | Flaws (date added to CISA's list) | What an attacker can do |
|---|---|---|
| Fortinet FortiOS (FortiGate) | CVE-2025-68686 (July 27), CVE-2025-25249 (September 9), CVE-2025-61624 (October 16) | Get around an earlier fix for hidden access left by past attacks, run code with crafted network traffic, or change files with an admin login. |
| SonicWall SMA1000 | CVE-2026-15409 and CVE-2026-15410 (July 14), CVE-2026-83548 and CVE-2026-83549 (September 2) | Reach internal functions without logging in and run commands as an admin. The July pair has been used in ransomware attacks. |
| Cisco Secure Firewall ASA and FTD | CVE-2026-20349 (August 11), CVE-2026-76418 (October 29) | Crash and restart the firewall's VPN without logging in. The October flaw affects SSL VPN setups that use secondary authentication, and more than 51,000 of those are exposed online. |
| Cisco Secure Firewall Management Center | CVE-2026-20316 (July 29), CVE-2026-20079 (September 9) | Log in with a built-in password, or skip the login entirely. The built-in password flaw has been used in ransomware attacks. |
| Citrix NetScaler ADC and Gateway | CVE-2026-8452 (August 26), CVE-2026-19490 (September 9), CVE-2026-88771 and CVE-2026-88772 (September 27), CVE-2026-88779 (October 4) | Get past the login on Gateway and SSL VPN setups, run commands without logging in, or crash the appliance. |
| Check Point Security Gateway and Spark firewalls | CVE-2026-85102 (September 22) | Run code on gateways that use site-to-site or remote access VPN, without logging in. |
| Check Point management (SmartConsole and Security Management Server) | CVE-2026-16232 (July 22), CVE-2026-93616 (September 22) | Take over full admin access, or upload and run scripts without logging in. |
| Palo Alto PAN-OS | CVE-2026-0322 (October 14) | Run code with full control of the firewall, using a valid login. Separately, the PHP2Shell flaws (listed October 26 as PHP flaws) let attackers take over firewalls whose management page is exposed to the internet. |
| Ivanti Connect Secure | CVE-2026-104935 (October 13), CVE-2026-111357 and CVE-2026-118527 (October 30) | Run commands without logging in, then take full control of the appliance. Attackers used its own account to read local admin passwords and BitLocker recovery keys from Active Directory. Fixed in 25.1.1.3 and 22.8R2.6. |
| F5 BIG-IP APM | CVE-2026-94127 (September 22) | Run code without logging in, on setups that use an OAuth profile. |
Each of these has a fix or a vendor workaround. Check your vendor's advisory for your exact model and version, and apply the same steps below: patch, keep management pages off the internet, and look for signs of a break-in. For the longer-term plan, see our guide on how to secure your firewall and VPN.
What your business should do now
1. Find every firewall and VPN gateway
List each firewall your business owns, including at branch offices and home offices, with its model, software version, and who manages it. Note whether it offers a VPN to remote staff and whether its management page can be reached from the internet.
2. Patch GlobalProtect, then everything else
Update Palo Alto firewalls to a fixed release from the table above. If you cannot update today, Palo Alto's workaround is to use a dedicated certificate only for authentication override cookies, or to turn authentication override off. Then bring every other firewall and VPN gateway up to current firmware; for Fortinet FortiWeb, that includes the fix for CVE-2025-64446 (FG-IR-25-910). Our patch management guide for small businesses covers how to keep devices like these current.
3. Take management pages off the internet
Firewall admin pages should only be reachable from inside your network or over a secure management connection. Unit 42 recommends checking whether a Palo Alto firewall answers management requests on ports 4443 and 3879 from the internet and restricting that access. Group-IB gives the same advice for every internet-facing device. It matters even more now: the PHP2Shell attacks on PAN-OS go after exactly these management pages.
4. Fix weak passwords and turn on MFA
Change default and common admin passwords, require MFA for every admin and VPN account, and lengthen lockout times so password guessing is slower. If your firewall can encrypt saved passwords with your own key instead of the manufacturer's default, turn that on.
5. Treat an exposed configuration as stolen passwords
Firewall configurations often hold passwords for VPN users, directory connections, and other services. If a device may have been accessed, change every password it holds. Use a low-privilege account for the firewall's connection to your company directory, so a stolen copy cannot do much damage.
6. Look for signs of a break-in
Preserve firewall and VPN logs before making changes. Then look for:
- VPN sessions from unfamiliar devices, locations, or accounts. Unit 42 lists IP addresses and device details to search for in GlobalProtect logs.
- New admin accounts, API keys, or configuration changes on the firewall.
- Remote access or remote management software on computers that you did not install.
- Large uploads to cloud storage services, especially MEGA or Wasabi, or the file-copying tool Rclone.
If you find any of these, treat it as an incident and get help before the attackers reach your backups.
7. Protect your backups
Attackers in these intrusions went after backup systems. Patch your backup software, keep at least one copy that cannot be changed or deleted from the main network, and test that you can restore from it. Our data backup services page explains what a recoverable setup looks like.
Should you keep a VPN on your firewall at all?
Every internet-facing VPN gateway is a door attackers can scan around the clock, and this campaign shows how often those doors get tried. Many businesses are replacing traditional firewall VPNs with Zero Trust Network Access, which gives staff access to specific applications without putting a public gateway on the internet. Our post on moving from SSL VPN to ZTNA explains the difference.
What to ask your IT provider
- Do we use Palo Alto GlobalProtect, and is it patched for CVE-2026-0257?
- Do we use authentication override cookies on GlobalProtect, and with which certificate?
- Which other firewalls and VPN gateways do we have, and what software version is each running?
- Do we run any of the other products CISA has listed as exploited this year, and are they patched?
- Are any firewall management pages reachable from the internet?
- Do all admin and VPN accounts require MFA, and have default passwords been changed?
- Have you checked our VPN logs for unfamiliar sessions since May?
- Can our backups be deleted or encrypted by someone who gets into our network?
How Spot On Tech helps
For the businesses we manage, firewall patching, configuration reviews, and monitoring are part of the same service, and we moved the networks we manage off public SSL VPN gateways to Zero Trust Network Access. Our cybersecurity services cover vulnerability response and monitoring, and a technology risk assessment finds the forgotten firewalls, open management pages, and old passwords that campaigns like this depend on.
If you are a New York or New Jersey business and are not sure whether your firewall or VPN is exposed, talk with Spot On Tech.
Frequently asked questions
What is CVE-2026-0257?
CVE-2026-0257 is an authentication bypass in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS firewalls. It lets an attacker set up an unauthorized VPN connection. Palo Alto released fixes on May 13, 2026, and CISA lists it as exploited.
Which ransomware groups are exploiting GlobalProtect?
Unit 42 named the Qilin and Inc ransomware groups on October 19, 2026. Public reports also link Settra ransomware operators to the flaw, which Unit 42 has not confirmed.
Does CVE-2026-0257 bypass MFA?
Unit 42 reports that attackers are bypassing multi-factor authentication to establish VPN sessions. MFA is still essential, but it does not protect an unpatched GlobalProtect gateway from this flaw.
Which PAN-OS versions fix CVE-2026-0257?
PAN-OS 12.1.7, 11.2.12, 11.1.15, and 10.2.18-h6 and later fix it, along with hotfixes for earlier builds of each release listed in Palo Alto's advisory. Older, unsupported releases must upgrade.
Is my GlobalProtect firewall affected?
It is at risk if it runs an unpatched PAN-OS release and its GlobalProtect portal or gateway uses authentication override cookies with the certificate setup described in Palo Alto's advisory. Cloud NGFW is not affected. Patching is the safest answer either way.
Are other firewalls and VPNs being exploited in 2026?
Yes. Since July 2026, CISA has added 24 exploited flaws in Fortinet FortiOS, SonicWall SMA1000, Cisco Secure Firewall, Citrix NetScaler, Check Point, Ivanti Connect Secure, F5 BIG-IP APM, and Palo Alto PAN-OS to its Known Exploited Vulnerabilities list. Three have been used in ransomware attacks. Patch any of these products you run.
Who is k0t?
k0t is the likely main operator of a campaign against firewalls and VPN gateways, including GlobalProtect, identified by Group-IB and NyxLab in October 2026. The researchers believe k0t sells network access, and many victims later appeared on Qilin and The Gentlemen ransomware leak sites.
Does patching remove attackers who already got in?
No. A patch closes the flaw, but it does not remove VPN accounts, remote access tools, or stolen passwords an attacker already has. Check for signs of a break-in and change passwords stored on the device.
