If you have a Palo Alto firewall and a GlobalProtect portal, here is an uncomfortable timeline: the vendor disclosed CVE-2026-0257 on 13 May, CISA put it on its Known Exploited Vulnerabilities list on 29 May, and on 12 October ReliaQuest was still reporting ransomware crews walking in through it. That is five months. The flaw is not new; the unpatched devices are.
What the bug is
CVE-2026-0257 is an authentication bypass in the GlobalProtect portal and gateway on PAN-OS, and in Prisma Access. Infosecurity Magazine lists PAN-OS 10.2.0, 11.1.0, 11.2.0 and 12.1.0 and Prisma Access 10.2.0 and 11.2.0 as affected. Panorama and Cloud NGFW are not. Exposure depends on configuration: GBHackers, relaying ReliaQuest, says authentication override cookies must be enabled alongside a particular certificate setup, so having GlobalProtect is not by itself proof you are vulnerable. Nor is it proof you are safe, which is why you should check the config rather than assume.
Scoring is another place where sources diverge. Palo Alto rated it 7.8 with its highest urgency; the US NVD rated it 9.1. Palo Alto also said at disclosure that it knew of "limited exploit attempts on unpatched PAN-OS devices without mitigations applied". When a vendor score and a national database score are fifteen percent apart, the safer move is to rank by exploitation, not by number. Exploitation was reported by Rapid7 in late May, Unit 42 in June and Arctic Wolf in July.
What the ransomware crews do with it
ReliaQuest says several groups are using it, naming Qilin and Settra, and expects exploitation to stay high for the next three months. The VPN is the front door, and a login that works looks exactly like someone working from home. After that, the reported tooling is the familiar kit of Cobalt Strike, BloodHound and SharpHound, though not every intrusion uses all three. One practical lead: sessions where the client hostname contains "kali". ReliaQuest is clear that this is a lead and not an attribution.
The advice that matters most is the sentence people skip. Patching does not evict someone who is already inside, because the session and any credentials they harvested survive the upgrade.
A checklist for the VPN team
- Find out which PAN-OS and Prisma Access versions you run and confirm against the Palo Alto advisory that you are on a fixed release. We have not reproduced fixed version numbers here because the sources we read do not give them.
- Disable authentication override cookies unless something specific depends on them, then check the certificate settings the advisory describes.
- After upgrading, terminate every active GlobalProtect session. Do not wait for them to expire.
- Review GlobalProtect logs from May onward for logins from unfamiliar clients, odd hostnames and addresses outside your usual geographies. ReliaQuest lists four addresses in the 216.245.184.0 range as indicators; the report is ambiguous on what each represents, so treat them as hunting leads and check before blocking.
- Assume stolen credentials for any account that authenticated through a suspect session: rotate them, and look at what those accounts touched inside the network.
- Put VPN appliances on a patch clock of days, not quarters. They are the one device every attacker can reach without a phishing email.
A five-month-old KEV entry still paying out for ransomware affiliates says something simple about attack surface: it is the sum of what you forgot to retire. If you want help auditing remote-access infrastructure and the response that follows a suspected intrusion, email sales@halfteck.com.