GlobalProtect authentication bypass used as a ransomware front door
Arctic Wolf traced multiple June 2026 Qilin intrusions to a patched PAN-OS GlobalProtect authentication bypass that lets attackers open a VPN session without valid credentials where authentication override cookies are misconfigured. Unit 42 tracks the flaw as CVE-2026-0257 and reported in October 2026 that Qilin and INC operators used it, in one case pivoting to vCenter and dumping credentials offline from a domain controller's virtual disk.
- Victim
- Multiple: organizations running unpatched PAN-OS GlobalProtect
- Industry
- Cross-industry
- Country
- Global
- Intrusion began
- Jun 2026
- First disclosed
- Jul 21, 2026
- Actor
- Qilin (Spikey Scorpius) and INC (Tarnished Scorpius) ransomware affiliates, per Arctic Wolf and Unit 42 (Extortion group)
- Initial access
- Identity infrastructure vulnerability
- Identity control that failed
- Session and tokens
- MFA
- Present and bypassed
- Abused identity
- Human account
- Records affected
- Not disclosed
- Disclosed cost
- Not disclosed
The identity lesson
A forgeable session cookie stood in for the user's login and MFA. A dedicated certificate for authentication override cookies, or disabling the override, plus prompt patching of VPN gateways, are the controls Palo Alto Networks recommends.
Go deeper on SWI
- Product involved: Palo Alto Prisma Access
- SWI coverage: qilin ransomware exploits pan os auth bypass for initial access
- SWI coverage: qilin and inc use globalprotect auth bypass to skip mfa and dump dc disks
Sources
- Qilin Ransomware Attackers Exploit PAN-OS Authentication Bypass for Initial Access, The Hacker News, Jul 21, 2026
- Active Exploitation of May 2026 PAN-OS CVE-2026-0257 (Updated October 20), Unit 42, Palo Alto Networks, Oct 20, 2026
Record verified Oct 31, 2026 against the sources above. Corrections: contact us.
Related incidents
- Ivanti Connect Secure header-spoofing auth bypass exploited to harvest AD credentials 2026 · Identity infrastructure vulnerability
- MITRE NERVE network breached via Ivanti zero-days and session hijacking 2024 · Identity infrastructure vulnerability
- Comcast Xfinity customer data theft via Citrix Bleed 2023 · Identity infrastructure vulnerability
- Boeing Distribution breached by LockBit via Citrix Bleed session hijacking 2023 · Identity infrastructure vulnerability
Cite this record
SWI Community Team. (2026). GlobalProtect authentication bypass used as a ransomware front door. Identity Breach Database, Start with Identity. https://startwithidentity.com/breaches/incidents/2026-pan-os-globalprotect-auth-bypass-ransomware/
Part of the Identity Breach Database, free to reuse under CC BY 4.0. Analysis across every record: Identity Breach Report 2026.