CVE-2026-0257: How to Detect & Patch PAN-OS GlobalProtect Bypass

Executive Summary

On October 20, 2026, Palo Alto Networks Unit 42 issued a critical intelligence update confirming active in-the-wild exploitation of PAN-OS CVE-2026-0257, a high-severity authentication bypass vulnerability residing in the GlobalProtect portal and gateway components. The flaw, initially listed on the Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities (KEV) catalog on May 13, 2026, is now being weaponized at scale by premier ransomware cartels, including Spikey Scorpius (operators of Qilin ransomware), Tarnished Scorpius (operators of Inc ransomware), and threat actors deploying Settra ransomware.

Adversaries exploit CVE-2026-0257 to bypass multi-factor authentication (MFA) and initiate unauthorized Virtual Private Network (VPN) sessions into corporate environments. Investigations across education, healthcare, financial services, manufacturing, energy, and government sectors reveal an alarming operational evolution: after breaching the perimeter, threat actors bypass traditional endpoints and pivot directly into the enterprise virtualization infrastructure. By compromising the VMware vCenter appliance, adversaries disable ESXi hypervisor security verification controls (execInstalledOnly) and deploy custom extraction tooling directly against hypervisor datastores to perform offline credential dumping of Active Directory Domain Controller virtual disks (VMDKs)—completely invisible to in-guest Endpoint Detection and Response (EDR) sensors.

Compounding this exposure, Unit 42 warned of a widespread architectural misconfiguration where administrators inadvertently map GlobalProtect profiles to HTTP/HTTPS services on firewall management interfaces, unintentionally exposing administrative consoles to the public internet on ports 4443 and 3879.

---

Technical Vulnerability Analysis & Attack Chain

Root-Cause & Exploitation Mechanics

The intrusion pipeline leverages an initial network-edge authentication flaw to initiate a deep, out-of-band pivot into the hypervisor tier, eliminating the need to interact with monitored Windows endpoints.

[ Adversary Infrastructure ] (e.g. 23.128.228.6)
           │
           │ 1. Exploits CVE-2026-0257 on GlobalProtect (Ports 443 / 4443 / 3879)
           ▼
[ PAN-OS GlobalProtect Gateway ]
           │
           │ 2. Authentication Bypass -> Tunnel Established (No MFA)
           ▼
[ Internal Corporate Network ]
           │
           │ 3. Lateral Movement via RDP/SMB & Dual-Use RMM Tools
           ▼
[ VMware vCenter Server Appliance ]
           │
           │ 4. Compromises vCenter & Disables ESXi "execInstalledOnly"
           ▼
[ ESXi Hypervisor Host & VMFS Datastore ]
           │
           │ 5. Custom Tool Mounts Offline DC Virtual Disk (*.vmdk)
           ▼
[ Offline Active Directory Dumping (NTDS.dit) ] -> In-Guest EDR Completely Blind!
           │
           │ 6. Chains Veeam Exploit (CVE-2023-27532) & Deploys Qilin/Inc Ransomware
           ▼
[ Full Enterprise VMFS & VM Data Encryption ]

1. Authentication Bypass Mechanics (CVE-2026-0257)

PAN-OS GlobalProtect portals and gateways implement complex session validation logic to handle client connection handshakes. In vulnerable software versions, improper handling of crafted client handshake sequences allows an unauthenticated external attacker to manipulate state variables within the authentication pre-negotiation phase.

• MFA Neutralization: The validation routines accept forged pre-authentication indicators, causing the gateway to treat the incoming connection as authenticated and established.
• Tunnel Instantiation: The gateway issues a virtual IP address and instantiates a fully functional VPN tunnel without ever prompting for LDAP/RADIUS credentials or completing SAML/MFA challenges.

2. The Management Interface Exposure Catalyst (Ports 4443 & 3879)

During incident response engagements across campaigns designated Lunar Peak, Unit 42 identified an administrative pitfall:

• Network administrators routinely map GlobalProtect (GP) service profiles to HTTP/HTTPS interfaces on firewall management ports.
• This creates unintended external access routes where the management interface is exposed directly to the WAN on non-standard ports, predominantly TCP 4443 and TCP 3879.
• Attackers exploit this dual exposure to target both external GlobalProtect interfaces and exposed management daemon APIs simultaneously.

3. Hypervisor Lateral Pivot & Disabling ESXi Controls

Once inside the internal network via the rogue VPN session, adversaries eschew noisy workstation compromises and target core virtualization management:

• Threat actors leverage stolen administrative credentials or dual-use Remote Monitoring and Management (RMM) software to compromise the VMware vCenter appliance.
• From vCenter, adversaries connect via SSH or API to individual VMware ESXi hypervisor hosts.
• To execute arbitrary binaries within the hypervisor shell, attackers disable ESXi native security enforcement by running:

esxcli system settings security set --exec-installed-only=false

Disabling execInstalledOnly removes the hypervisor requirement that all running code must originate from cryptographically verified VIB (vSphere Installation Bundle) packages.

4. Stealth Offline NTDS Extraction from Raw VMDKs

Rather than invoking lsass.exe dumping or Volume Shadow Copy Service (vssadmin) commands inside Windows—which reliably trigger modern EDR sensors—the actors employ custom hypervisor-native binaries:

• The attacker's custom utility reads the raw virtual disk file (.vmdk) of the virtualized Active Directory Domain Controller directly from the underlying VMFS datastore.
• The tool parses the offline NTFS structure to copy C:\Windows\NTDS\ntds.dit and the SYSTEM registry hive.
• Because the extraction occurs entirely at the storage layer outside the virtual machine's OS, the guest operating system's kernel, event loggers, and EDR agents remain completely unaware of the credential theft.

5. Disaster Recovery Neutralization & Ransomware Deployment

Prior to launching encryptors, actors systematically eliminate recovery routes:

• Adversaries chain exploitation tools against backup servers, specifically weaponizing CVE-2023-27532 in Veeam Backup & Replication to extract administrative credentials and delete backup repositories.
• Finally, ransomware binaries belonging to Qilin (Spikey Scorpius), Inc (Tarnished Scorpius), or Settra are distributed across both Windows virtual machines and ESXi hypervisors, encrypting virtual disks (.vmdk, .vmx) and shutting down enterprise operations.

---

MITRE ATT&CK Tactics, Techniques & Procedures (TTPs)

---

Threat Actor Profile & Campaign Attribution

The campaign unites sophisticated initial-access broker (IAB) techniques with aggressive double-extortion ransomware operations:

Threat Actor Attribution & Alignment:
├── Spikey Scorpius (Qilin Ransomware Gang)
│   ├── Target Sectors: Healthcare, Critical Manufacturing, Energy, Legal
│   └── Tradecraft: Hypervisor-level VMFS encryption, multi-stage data leak extortion
├── Tarnished Scorpius (Inc Ransomware Gang)
│   ├── Target Sectors: Education, Government, Financial Services, Transportation
│   └── Tradecraft: Offline VMDK mounting, backup deletion, targeted high-extortion demands
└── Settra Ransomware Operators
    └── Tradecraft: Rapid post-access deployment, automated network reconnaissance

The evolution toward direct hypervisor compromise indicates that ransomware syndicates are actively adapting to ubiquitous EDR adoption by moving upstream into virtualization layers where traditional host monitoring tools cannot inspect execution.

---

Detection & SOC Mitigation Playbook

1. Concrete Remediation & Workarounds

Defenders must execute the following remediation protocol immediately across all perimeter firewalls and hypervisor clusters:

Step 1: Apply Official PAN-OS Security Hotfixes

Upgrade all Palo Alto Networks firewalls to fixed PAN-OS releases as specified in the vendor security advisory. Follow official guidance to ensure maintenance releases are verified before installation.

Step 2: Remediate Management Interface Exposure (Ports 4443 & 3879)

Audit and unbind GlobalProtect profiles from management interfaces:

1. In the PAN-OS web interface, navigate to Network > Network Profiles > Interface Management.
2. Ensure that management profiles applied to interfaces connected to untrusted zones have HTTP, HTTPS, Telnet, and SSH disabled.
3. Test external exposure from an out-of-band external terminal:

# Test for accidental exposure of management ports on firewall public WAN IPs
curl -k -v --connect-timeout 5 https://<FIREWALL_PUBLIC_IP>:4443/
curl -k -v --connect-timeout 5 https://<FIREWALL_PUBLIC_IP>:3879/

If a connection responds, immediately navigate to Device > Setup > Management and reconfigure interface access rules to restrict access strictly to internal management subnets.

Step 3: Re-Enable and Enforce ESXi execInstalledOnly

Ensure that all VMware ESXi hypervisors enforce code integrity:

# Check current execInstalledOnly status
esxcli system settings security get

# Re-enable strict execution controls if disabled
esxcli system settings security set --exec-installed-only=true

Step 4: Revoke and Reset Enterprise Administrative Credentials

Because threat actors have demonstrated the ability to harvest domain-wide credentials via offline VMDK dumping:

1. Perform a dual reset of the Active Directory KRBTGT account password (separated by 12–24 hours to allow replication).
2. Reset all Domain Admin, Enterprise Admin, and vCenter administrative passwords.

---

2. Network & Perimeter Defenses

1. Firewall Ingress Blocks: Implement immediate perimeter firewall drops for verified threat actor ingress IP addresses:

# Network Ingress Blocklist (Palo Alto / Cisco / Linux iptables)
23.128.228.6
104.207.144.154
146.19.216.119
146.19.216.120
146.19.216.125
179.43.172.213
185.195.232.139
198.12.106.60
202.144.192.47

1. Network Segmentation of Management Networks: Completely isolate vCenter management interfaces and ESXi management VMkernel ports onto dedicated, non-routable VLANs accessible only via multi-homed bastion jump boxes requiring dedicated hardware MFA.

---

3. Endpoint Detection & Hunting Query

Validated Sigma Rule (YAML)

The following Sigma rule detects unauthorized GlobalProtect VPN connections originating from known exploit PoC parameters and suspicious device artifacts:

title: Suspicious PAN-OS GlobalProtect Session via CVE-2026-0257 Artifacts
id: d4a28f11-9e23-4b67-a89c-501b44ec9312
status: test
description: Detects successful GlobalProtect gateway-connected events matching hard-coded PoC client configuration values, suspicious MAC addresses, or threat actor host IDs associated with CVE-2026-0257 exploitation.
references:
    - https://unit42.paloaltonetworks.com/active-exploitation-of-pan-os-cve-2026-0257/?ref=cybernewsai.com
    - https://attack.mitre.org/techniques/T1190/
author: CyberNewsAI Threat Research Team
date: 2026/10/20
logsource:
    product: pan_os
    service: globalprotect
detection:
    selection_event:
        EventID: 'gateway-connected'
    selection_suspicious_hosts:
        HostName:
            - 'WINDOWS-LAPTOP-001'
            - 'DESKTOP-GP01'
            - 'GP-CLIENT'
    selection_suspicious_macs:
        ClientMAC:
            - 'aa:bb:cc:dd:ee:ff'
            - '00:11:22:33:44:55'
    selection_poc_params:
        EndpointOS: 'Microsoft Windows 10 Pro 64-bit'
        UserDomain: ''
    condition: selection_event and (selection_suspicious_hosts or selection_suspicious_macs or selection_poc_params)
falsepositives:
    - Rare legitimate test clients configured with dummy MAC addresses in staging environments.
level: critical
tags:
    - attack.initial_access
    - attack.t1190
    - attack.t1556

Microsoft Sentinel / Defender KQL Hunting Query

Search for GlobalProtect gateway connections matching threat actor indicators and audit ESXi security changes:

// Query 1: Hunt for Successful GlobalProtect Connections from Malicious IPs or Artifacts
let MaliciousIPs = dynamic([
    "23.128.228.6", "104.207.144.154", "146.19.216.119", "146.19.216.120",
    "146.19.216.125", "179.43.172.213", "185.195.232.139", "198.12.106.60", "202.144.192.47"
]);
let SuspiciousMACs = dynamic(["aa:bb:cc:dd:ee:ff", "00:11:22:33:44:55"]);
let SuspiciousHosts = dynamic(["WINDOWS-LAPTOP-001", "DESKTOP-GP01", "GP-CLIENT"]);
CommonSecurityLog
| where DeviceVendor =~ "Palo Alto Networks" and Activity =~ "globalprotect"
| where Message has "gateway-connected"
| where SourceIP in (MaliciousIPs) or DeviceCustomString1 in (SuspiciousMACs) or DestinationHostName in (SuspiciousHosts)
| project
    TimeGenerated,
    SourceIP,
    DestinationIP,
    DestinationHostName,
    DeviceCustomString1, // Client MAC
    Message,
    Activity
| order by TimeGenerated desc

// Query 2: Hunt for ESXi execInstalledOnly Tampering in Syslog
Syslog
| where ProcessName =~ "esxcli" or SyslogMessage has "exec-installed-only"
| where SyslogMessage has "false"
| project TimeGenerated, HostName, ProcessName, SyslogMessage

Splunk (SPL) Hunting Query

Search Palo Alto Networks firewall logs for GlobalProtect authentication anomalies:

index=pan_logs sourcetype="pan:globalprotect" event_id="gateway-connected"
(src_ip IN ("23.128.228.6", "104.207.144.154", "146.19.216.119", "146.19.216.120", "146.19.216.125", "179.43.172.213", "185.195.232.139", "198.12.106.60", "202.144.192.47")
 OR client_mac IN ("aa:bb:cc:dd:ee:ff", "00:11:22:33:44:55")
 OR host_name IN ("WINDOWS-LAPTOP-001", "DESKTOP-GP01", "GP-CLIENT")
 OR (os_version="Microsoft Windows 10 Pro 64-bit" AND user_domain=""))
| table _time src_ip user host_name client_mac os_version status
| sort - _time

---

(Note: Authoritative advisories identify network ingress infrastructure and connection metadata; hunt using firewall telemetry and hypervisor configuration audits above.)