TL;DR: CVE-2026-0257 is an authentication bypass in Palo Alto Networks PAN-OS GlobalProtect and Prisma Access that ransomware groups are now using to open unauthorized VPN sessions, so affected firewalls should be patched, sessions reset, and logs reviewed for access that predates the fix. INVITE treats this as a patch-then-hunt job because upgrading does not remove an intruder who is already inside. This briefing is for CISOs, IT Directors, and VPs of IT at mid-market and enterprise organizations that run GlobalProtect. What is the GlobalProtect flaw, CVE-2026-0257? CVE-2026-0257 is an authentication bypass in the GlobalProtect feature of PAN-OS and in Prisma Access that lets a remote attacker establish a VPN connection without valid credentials. Palo Alto Networks disclosed it on May 13, and CISA added it to the Known Exploited Vulnerabilities catalog on May 29 after attacks were observed. Exposure depends on configuration: the risk applies when authentication override cookies are enabled alongside a specific certificate setup. Why is it back in the news in October? Researchers at ReliaQuest report that the Qilin and Settra ransomware groups are exploiting the flaw to create unauthorized VPN sessions and enter internal networks. They also observed Cobalt Strike, BloodHound, and SharpHound activity, which are tools used to move laterally and map Active Directory after initial access. The shift matters because the flaw started as an access problem and is now a ransomware precursor. Which versions are affected? PAN-OS 12.1, 11.2, 11.1, and 10.2 are affected, along with Prisma Access 11.2 and 10.2. Panorama and Cloud NGFW are not affected. Check your exact maintenance release against Palo Alto Networks’ fixed version table, including on-premises firewalls that sit in hybrid Prisma Access environments. How do you patch GlobalProtect and check for compromise? Patch and hunt in the same change window, in this order: Upgrade immediately. Move to a fixed release from the vendor table. Treat this as an emergency change. Disable authentication override cookies where they are not needed, or generate a new certificate dedicated to those cookies. Terminate all active GlobalProtect sessions after patching, so every user must re-authenticate. Hunt for access that predates the fix. Review VPN logs for sessions without matching identity provider events, then look for Cobalt Strike beacons and BloodHound or SharpHound enumeration on internal hosts. Rotate credentials for accounts that connected through the gateway during the exposure window. Patching alone is not enough. A fix closes the door, but it does not evict someone who walked through it last month. What outcomes should you measure? Track time to patch an exploited edge flaw, dwell time before an intrusion is found, and the percentage of VPN and edge devices with continuous log coverage. Those three numbers tell you whether your team would have caught this on day one or month three. INVITE’s managed detection and response guidance explains how a 24×7 team closes that gap, and the same patch-then-hunt discipline appears in our posts on the Cisco SD-WAN zero-day and the Citrix NetScaler SAML flaw. As a Palo Alto Networks partner, INVITE engineers in Salt Lake City and Phoenix can review your GlobalProtect configuration and run a compromise assessment through INVITE cybersecurity services. Frequently Asked Questions Is every GlobalProtect deployment vulnerable to CVE-2026-0257?No. Risk depends on configuration, specifically authentication override cookies combined with a particular certificate setup. Review your portal and gateway settings rather than assuming you are safe. Is patching enough?No. Attackers used the flaw before many organizations patched, so you must also look for unauthorized sessions and post-access tooling created before the upgrade. Why terminate active sessions after patching?Sessions established through the flaw may remain valid after the upgrade. Ending them forces re-authentication and removes any attacker who is still connected. Does this affect Prisma Access?Yes, Prisma Access 11.2 and 10.2 are listed as affected. Hybrid environments should also patch on-premises firewalls. Who can help check our environment?INVITE security engineers can review exposure and run a compromise assessment. Schedule a 30-minute architecture review with an INVITE security engineer.
