GlobalProtect portal and gateway authentication bypass grants unauthorized VPN sessions in PAN-OS and Prisma Access (CVE-2026-0257)
Palo Alto Networks disclosed on 2026-10-20 that it is still observing Qilin and INC ransomware operators exploiting this bypass against unpatched devices five months after fixes shipped, so any GlobalProtect portal or gateway still on a vulnerable build with authentication override cookies enabled is a standing ransomware entry point.
Authentication bypass flaws in the GlobalProtect portal and gateway of PAN-OS and Prisma Access let an unauthenticated remote attacker establish a VPN connection without valid credentials, sidestepping MFA and landing inside the protected network. Arctic Wolf has traced intrusions through this flaw to Qilin ransomware deployment. Panorama and Cloud NGFW are not affected.
Affected: PAN-OS 12.1 earlier than 12.1.4-h6 / 12.1.7; PAN-OS 11.2 earlier than 11.2.4-h17 / 11.2.7-h14 / 11.2.10-h7 / 11.2.12; PAN-OS 11.1 earlier than 11.1.4-h33 / 11.1.6-h32 / 11.1.7-h6 / 11.1.10-h25 / 11.1.13-h5 / 11.1.15; PAN-OS 10.2 earlier than 10.2.7-h34 / 10.2.10-h36 / 10.2.13-h21 / 10.2.16-h7 / 10.2.18-h6; Prisma Access 11.2.0 earlier than 11.2.7-h13; Prisma Access 10.2.0 earlier than 10.2.10-h36; Not affected: Panorama, Cloud NGFW
How to Test
On every firewall that hosts a GlobalProtect portal or gateway, compare the running PAN-OS version against the fixed builds listed above and check whether authentication override cookies are enabled, the configuration Palo Alto Networks lists, together with a specific certificate configuration, as required for exposure; for Prisma Access, confirm with Palo Alto Networks that your tenant has been moved to 11.2.7-h13 or 10.2.10-h36 or later under their upgrade schedule. Review GlobalProtect portal and gateway logs for VPN sessions from unexpected users or source addresses and for sessions that completed without the expected MFA step; any such session on a device that was unpatched is a potential intrusion precursor, so hunt internal hosts reachable from the VPN address pool for follow-on Qilin or INC ransomware activity.
How to Patch
Upgrade PAN-OS to a fixed build: 12.1.4-h6 or 12.1.7 and later; 11.2.4-h17, 11.2.7-h14, 11.2.10-h7, or 11.2.12 and later; 11.1.4-h33, 11.1.6-h32, 11.1.7-h6, 11.1.10-h25, 11.1.13-h5, or 11.1.15 and later; 10.2.7-h34, 10.2.10-h36, 10.2.13-h21, 10.2.16-h7, or 10.2.18-h6 and later. Prisma Access is fixed in 11.2.7-h13 and 10.2.10-h36 and is being upgraded by Palo Alto Networks per the schedule shared with customers; confirm your tenant has received it.