Unit 42 threat brief update, October 19, 2026; reporting published October 21, 2026
Ransomware Gangs Are Still Walking Through a Patched GlobalProtect Flaw, and Patching Alone Will Not Evict Them
Palo Alto Networks' Unit 42 updated its threat brief on CVE-2026-0257, an authentication bypass in PAN-OS GlobalProtect disclosed on May 13, 2026 and KEV-listed that month, naming Qilin and Inc among the ransomware operators exploiting it, with ReliaQuest also tracking Settra. The flaw stems from firewalls relying on authentication override cookies without detailed validation, so a remote attacker can establish a VPN session without valid credentials and bypass multifactor authentication entirely; because the session arrives through the organization's own VPN, it can resemble ordinary remote work. Unit 42's incident responders have investigated intrusions tied to the flaw since early June: in one case attackers moved from the VPN gateway to the vCenter appliance, disabled a security control on ESXi hosts, and extracted domain credentials from a domain controller's virtual disk, bypassing in-guest endpoint detection, and they have also chained the access with tooling against Veeam backup infrastructure (CVE-2023-27532). ReliaQuest advises patching, disabling authentication override cookies where they are not needed, and terminating all active GlobalProtect sessions after patching, and assesses exploitation is highly likely to continue over the next three months.
Executives
A flaw patched in May is still producing ransomware intrusions in October because the attackers who got in before patching stayed in. The board question is not whether the patch is applied; it is whether anyone hunted for access established before the patch, and whether VPN sessions were forcibly ended afterward.
CIO / CISO
Sequence the response as an incident, not a maintenance task: patch, disable unneeded authentication override cookies, terminate all active sessions, rotate exposed credentials, and review VPN logs for sessions with odd hostnames and for movement toward vCenter, ESXi, and backup systems. Segment VPN landing zones away from hypervisor management and domain controllers.
Engineers
Apply the fixed PAN-OS and Prisma Access releases, then hunt: review gateway-connected events and source IPs, inspect RDP and SMB lateral movement, check ESXi execInstalledOnly settings and vCenter changes, and review Veeam servers for exploitation attempts via CVE-2023-27532. Patching without the session termination step leaves attacker sessions alive.
Everyone (non-IT)
Attackers used this flaw to log in through the company VPN as if they were employees working from home, skipping the second login factor entirely. If your IT team suddenly ends all VPN sessions and asks everyone to reconnect, this kind of cleanup is usually why.