1-minute read
What a defender needs to know
Palo Alto Networks Unit 42’s October 19 update links active exploitation of GlobalProtect CVE-2026-0257 to ransomware operators. In one investigation, intruders entered through a VPN gateway, reached vCenter, disabled ESXi execInstalledOnly controls and dumped credentials offline from a domain controller VMDK. The vulnerability affects certain PAN-OS portals and gateways with authentication-override cookies and a specific certificate configuration. Panorama and Cloud NGFW are unaffected; Prisma Access has separate affected releases. Earlier probes produced successful sessions on only a small portion of probed devices.
Check portal and gateway authentication-override settings, certificate assignments and installed builds against the Palo Alto Networks advisory. Upgrade cookie-using internal and external GlobalProtect components together to the applicable fixed releases; make sure strict cookie HMAC validation is enabled after any phased-upgrade compatibility period. Users will re-authenticate once after the fix.
In GlobalProtect logs, investigate successful gateway-connected events matching Unit 42’s indicators: pre-May 29 source IPs 23.128.228[.]6, 104.207.144[.]154, 146.19.216[.]119, 146.19.216[.]120, 146.19.216[.]125, 179.43.172[.]213, 185.195.232[.]139, 198.12.106[.]60, 202.144.192[.]47; host IDs aa:bb:cc:dd:ee:ff, 00:11:22:33:44:55; device names WINDOWS-LAPTOP-001, DESKTOP-GP01, GP-CLIENT; or post-release endpoint_os_version = Microsoft Windows 10 Pro 64-bit with empty source_user_info.domain. Tie suspicious sessions to vCenter logins, ESXi changes and virtual-disk access. Verify fixed builds, strict HMAC and a legitimate fresh VPN connection; investigate historic sessions separately. Guest EDR can miss offline disk access.