A GlobalProtect flaw in Palo Alto Networks firewalls is still being actively exploited five months after it was patched. Unit 42 reports at least three ransomware groups using it for initial access to corporate networks.
An authentication bypass flaw in GlobalProtect, the remote-access component of Palo Alto Networks firewalls, is still being actively exploited five months after disclosure. A threat brief updated on 19 October by Unit 42, Palo Alto Networks' own research team, reports that at least three ransomware operations now use it for initial access to corporate networks.
What the flaw actually does
The vulnerability, tracked as CVE-2026-0257, affects GlobalProtect portal and gateway deployments where the authentication override cookie feature is enabled alongside a particular certificate configuration. The firewall accepts those cookies without validating their integrity, so an unauthenticated attacker can open a legitimate VPN session. The Hacker News reports a CVSS score of 7.8. Both physical and virtual PAN-OS firewalls are affected, as is Prisma Access.
Critically, the flaw sidesteps multi-factor authentication entirely: an attacker lands inside the network without a username or password, so any remote-access design treating MFA as its single line of defence offers no protection here.
Why it is still in the headlines
Palo Alto Networks disclosed the issue on 13 May 2026, and it was added to CISA's Known Exploited Vulnerabilities catalogue the same day. Rapid7 reported two waves of attacks, on 17 and 21 May. Exploitation climbed after a public proof-of-concept appeared on 29 May, and Unit 42 incident responders began investigating related intrusions in early June.
Unit 42 names the Qilin and Inc ransomware operations among those abusing the flaw, while ReliaQuest adds Settra to the list. Once inside over VPN, attackers run reconnaissance with legitimate remote management tooling, move laterally over RDP and SMB, then progress to credential harvesting, data exfiltration and ransomware. In one case documented by Unit 42, the attacker pivoted from the VPN gateway to a vCenter appliance, disabled security controls on the ESXi hosts and extracted credentials offline from a domain controller's virtual disk. Help Net Security reports that ReliaQuest expects exploitation to continue over the next three months.
What this means for Turkish SMBs
The sectors highlighted in the reports are healthcare, education, government and energy, but the lesson for smaller organisations lies elsewhere: this is not an enterprise-only problem, it is a remote-access architecture problem. In Turkey, VPN setups built for home working, branch connectivity and supplier access are typically configured once and never revisited. Three practical consequences follow:
- Firewall firmware updates slip further than server and endpoint patching, because fear of downtime pushes the maintenance window out by months.
- A device left unpatched in May carries historical risk even if patched today. ReliaQuest's warning is blunt: patching alone may not remove access established before remediation.
- Under the obligations of Turkey's Cybersecurity Law No. 7545 and KVKK data security requirements, leaving a publicly disclosed and catalogued vulnerability open for months is not a defensible position.
What Kamer Bilişim recommends
- Confirm your firewall inventory and the firmware actually running, this week. If you run PAN-OS, upgrade to the release named in the vendor advisory. Until then, disable the authentication override cookie feature or assign it a dedicated certificate, and verify the management interface is not reachable from the internet.
- Terminate every VPN session after patching, then review your logs retrospectively. Check GlobalProtect records from May onward for unfamiliar source addresses, unexpected device names and sessions outside working hours, and make sure remote-access logs are kept for at least six months.
- Do not rest remote access on a single layer. MFA is not sufficient on its own. Layer it with device posture checks, source IP restrictions, segmentation behind the VPN and a separate access path for privileged accounts. Also confirm you hold an isolated copy of your backups, offline or immutable.
For a firewall version check, a remote-access configuration review or a log investigation, reach us through our contact page. We provide on-site support across the Anatolian side of Istanbul and remote support elsewhere.
Source: Help Net Security, Palo Alto Networks Unit 42, The Hacker News
Source: Help Net Security