A vulnerability in Palo Alto Networks' GlobalProtect VPN software is giving ransomware crews a way to walk past multi-factor authentication and straight into corporate networks. Unit 42, the company's threat intelligence arm, detailed the activity in an October 19 update, tying exploitation to groups tracked as Spikey Scorpius and Tarnished Scorpius, also known publicly as Qilin and Inc. Separate reporting has linked the same flaw to operators deploying Settra ransomware.
How a login cookie becomes a skeleton key
The flaw, cataloged as CVE-2026-0257, revolves around a convenience feature called authentication override cookies. These let someone who has already logged in reconnect without repeating the full credential and MFA process. According to Rapid7's technical analysis, affected devices can decrypt these cookies but fail to properly confirm that a trusted system actually issued them. When the certificate used to sign these cookies is reused on a public-facing service, an attacker can retrieve its public key and forge a valid-looking cookie. The gateway then accepts it as proof the user already authenticated, granting VPN access without a password prompt or second factor. Palo Alto Networks rates the issue High severity, with a CVSS score of 7.8, and has issued its highest recommended response urgency. Panorama and Cloud NGFW deployments are not affected, but GlobalProtect portals and gateways running certain PAN-OS and Prisma Access configurations are exposed wherever override cookies are enabled alongside the vulnerable certificate setup.
This is a meaningful departure from the usual MFA-bypass playbook, which typically relies on phishing, SIM swapping, or exhausting users with repeated push notifications. Here, the authentication layer itself is tricked into believing a login already happened. It is a reminder that multi-factor authentication is only as strong as the session-management logic sitting underneath it.
From VPN foothold to virtual infrastructure
Once inside, investigators found attackers relying on legitimate remote monitoring and management tools to look around internal networks, then moving laterally using Remote Desktop Protocol and Server Message Block - standard enterprise administration channels that blend in with normal traffic. In the most striking case Unit 42 examined, the intrusion reached VMware's vCenter management appliance. From there, attackers disabled the execInstalledOnly security control on ESXi hosts and used a custom tool to pull credentials directly from a domain controller's virtual disk file, offline, without ever running code inside the virtual machine itself.
That detail matters. Endpoint detection and response tools watch what happens inside an operating system. By reading credentials straight off the VMDK file at the hypervisor layer, attackers sidestep that visibility entirely. The technique treats the virtualization infrastructure beneath a server as a separate, often less-monitored target in its own right - an approach that has shown up before in attacks involving detached domain controller disks, and one that security teams are still adapting their detection strategies to cover.
Unit 42 also observed some of these intrusions paired with a second, older vulnerability - CVE-2023-27532 - affecting Veeam backup infrastructure. That flaw can expose encrypted credentials stored in the backup configuration database, potentially giving attackers a path into backup hosts as well, which raises the stakes considerably: compromising both production systems and backups in the same campaign undermines an organization's ability to recover without paying a ransom.
What organizations should check now
The investigations, underway since early June, span healthcare, education, financial services, manufacturing, government, and energy organizations, suggesting broad and largely opportunistic targeting rather than a narrow, sector-specific campaign.
- Apply the Palo Alto Networks advisory and upgrade every affected GlobalProtect portal and gateway without delay.
- Where immediate patching isn't possible, disable authentication override or issue a new certificate used exclusively for override cookies, separate from any certificate shared with public services.
- Review GlobalProtect logs for successful gateway connections tied to unfamiliar sources, including the reported indicators 104.207.144[.]154 and 146.19.216[.]125, and device identifiers such as GP-CLIENT and DESKTOP-GP01.
- Treat connection events, not just login attempts, as the critical signal - earlier monitoring found many probes never completed a full VPN session, making successful connections the more telling indicator.
The episode underscores a broader shift in ransomware operations: increasingly, the most damaging moves happen not inside the operating systems defenders watch closely, but in the infrastructure layers underneath, where fewer tools are looking.