Attackers who entered through a vulnerable Palo Alto Networks GlobalProtect VPN gateway reached a vCenter appliance and dumped credentials from a domain controller’s virtual disk in one Unit 42 investigation. The October 19 update traces that path to CVE-2026-0257, an authentication bypass in PAN-OS GlobalProtect portals and gateways. A VPN session gave the intruders a route to the virtualization layer, where in-guest endpoint monitoring had little visibility into the offline disk access.
Unit 42, Palo Alto Networks’ research team, says it continues to see attempted exploitation by Spikey Scorpius, also called Qilin, and Tarnished Scorpius, also called Inc. It separately attributes Settra ransomware activity to public reporting. Its investigations since early June span education, finance, healthcare, government, manufacturing and other industries. Earlier probing produced successful VPN sessions on only a small portion of probed devices; investigate successful gateway-connected events as possible intrusions.
Authentication override creates the opening
The Palo Alto Networks advisory describes an authentication bypass in GlobalProtect’s portal and gateway that lets an attacker establish an unauthorized VPN connection. The CVE record classifies it as reliance on cookies without validation and integrity checking (CWE-565). The affected configuration combines authentication override cookies with a specific certificate configuration. For cookie-using portals and gateways, check the assigned certificate and installed build to establish exposure.
On a portal, inspect Network > GlobalProtect > Portals > portal name > Agent > agent configuration > Authentication: Generate cookie for authentication override or Accept cookie for authentication override. On a gateway, use Network > GlobalProtect > Gateways > gateway name > Agent > Client Settings > Authentication Override and inspect Accept cookie for authentication override. The vendor recommends a newly generated certificate dedicated exclusively to authentication-override cookies, stored securely and never reused as the portal or gateway certificate or shared with other features; disabling authentication override is its other mitigation. Panorama and Cloud NGFW are unaffected according to the advisory. Prisma Access has separate affected and fixed releases.
Intruders leave gateway-connected events
Unit 42 directs defenders to search GlobalProtect logs for successful gateway-connected events, not just connection attempts. For activity before the May 29 public proof-of-concept release, search source IPs 23.128.228[.]6, 104.207.144[.]154, 146.19.216[.]119, 146.19.216[.]120, 146.19.216[.]125, 179.43.172[.]213, 185.195.232[.]139, 198.12.106[.]60 and 202.144.192[.]47.
Across source IPs, look for successful sessions with host IDs aa:bb:cc:dd:ee:ff or 00:11:22:33:44:55, or device names WINDOWS-LAPTOP-001, DESKTOP-GP01 and GP-CLIENT. For post-proof-of-concept activity, Unit 42 also names the client values endpoint_os_version = Microsoft Windows 10 Pro 64-bit and an empty source_user_info.domain. Match the account, connection time and assigned VPN address to the endpoint inventory. A common-looking client value merits investigation in the context of a successful session; the log match is an investigation lead.
vCenter extends the intrusion
After VPN access, Unit 42 describes internal reconnaissance with dual-use remote management tools, movement over RDP and SMB, and staged tools for credential harvesting, exfiltration and ransomware. It calls the move into virtualization the “direct pivot to the virtualization layer.” In its notable case, intruders reached the vCenter management appliance from the compromised gateway, disabled execInstalledOnly security controls on ESXi hosts, and used a custom tool to dump credentials offline from a domain controller’s VMDK. Unit 42 also observed attackers combining this access with tools targeting Veeam backup infrastructure through CVE-2023-27532.
That sequence moves collection away from the domain controller’s running guest. Correlate the VPN account and assigned address with vCenter logins, ESXi configuration changes, and datastore or virtual-disk access around the same time. Guest EDR alone cannot see an offline read of the domain controller disk from the virtualization layer.
Patch the whole GlobalProtect estate
The advisory’s fixed branch targets include PAN-OS 12.1.7, 11.2.12, 11.1.15 and 10.2.18-h6; it also lists earlier fixed hotfixes within each branch. Prisma Access targets are 11.2.7-h13 and 10.2.10-h36, with customer upgrades scheduled by Palo Alto Networks. Match each installed release to the advisory’s specific fixed or unaffected row. Upgrade every internal and external portal and gateway that generates or accepts override cookies, including on-premises firewalls in a hybrid Prisma Access deployment. A mixed fixed/old estate can break cookie compatibility.
After a fixed PAN-OS upgrade, users of authentication-override cookies must authenticate again once because the firewall regenerates cookies by a stronger method. The vendor describes a temporary compatibility switch, set global-protect enable-auth-override-cookie-hmac no, during a phased upgrade. That switch restores legacy cookie behavior: finish the upgrades and set set global-protect enable-auth-override-cookie-hmac yes to enforce strict HMAC validation. Treat a fixed version with legacy validation still enabled as an incomplete remediation.
Verify VPN access and disk activity
Inventory portals and gateways with override cookies, record their certificate assignments and installed releases, and move each exposed instance to a fixed build or the vendor’s dedicated-certificate or disable-override mitigation. Then review successful gateway-connected events against the listed IPs, host IDs, device names and post-release client values. For a suspicious successful session, activate incident response and follow its account and VPN address into vCenter, ESXi control changes and domain controller VMDK access.
Verify every cookie-using portal and gateway reports an advisory-listed fixed version, strict cookie HMAC validation is enabled after the coordinated upgrade, and a legitimate user can re-authenticate and connect. Preserve and investigate earlier suspicious sessions separately: a fresh successful login test tells you the updated VPN works, while the older gateway and hypervisor records tell you what happened before it did.