Palo Alto Networks has continued to observe exploitation of a now-patched authentication bypass affecting PAN-OS and Prisma Access. The flaw, CVE-2026-0257 (CVSS 7.8), can allow an attacker to establish unauthorized VPN connections by bypassing MFA controls. Reporting associates current activity with encryption-based extortion operations tracked as Qilin and INC, which makes this a pre-ransomware access problem, not merely a firewall bug.
The operational risk is straightforward: if your internet-facing PAN-OS GlobalProtect/Prisma Access edge is not on the fixed May 2026 code, an attacker may convert a perimeter authentication weakness into an authenticated foothold. From there, ransomware affiliates typically pursue identity compromise, lateral movement, backup discovery, and encryption staging. Treat exposed PAN-OS VPN portals as critical attack surface until patched and hunted.
Technical Analysis
Affected platforms called out in the reporting are PAN-OS and Prisma Access, specifically in the context of VPN connectivity and MFA enforcement. CVE-2026-0257 is described as an authentication bypass with a CVSS score of 7.8. The precise affected build list and fixed target releases are not included in the source summary; defenders must pull the exact version matrix from Palo Alto Networks’ security advisory for CVE-2026-0257 and map it to each managed firewall, Panorama-managed estate, and Prisma Access tenant.
From a defender’s perspective, the dangerous outcome is not code execution on the firewall itself; it is the collapse of the trust boundary created by MFA. A bypass at the VPN authentication layer can produce a session that looks legitimate enough to blend into normal remote access telemetry. That matters because Qilin and INC intrusions generally monetize access quickly. Once a valid tunnel exists, the attacker can attempt internal reconnaissance, SMB/RDP/WinRM movement, credential theft from reachable endpoints, discovery of domain controllers and backup infrastructure, and deployment of encryption tooling.
Exploitation requirements appear to align with exposure of the relevant VPN/authentication service and a vulnerable PAN-OS/Prisma Access configuration. The source states Palo Alto patched the issue in May 2026 and continues to observe exploitation. It does not state whether a public PoC exists or whether the CVE has been added to CISA KEV; confirm KEV status directly against CISA’s catalog during triage. The safe assumption for SOC planning is confirmed active exploitation in the wild by financially motivated ransomware actors.
Detection & Response
Prioritize identity-edge telemetry over generic malware signatures. The highest-fidelity signals are authentication anomalies at PAN-OS/Prisma Access followed by internal post-authentication behavior consistent with ransomware tradecraft.
---
title: PAN-OS VPN Authentication Succeeded Without Corresponding MFA Success
id: 8f6c2b7a-3c5b-4f02-9d2a-7d1a2c8f0a11
status: experimental
description: Detects VPN tunnel establishment where authentication telemetry lacks an expected MFA success event for the same user and source within a short window. Tune event IDs/field mappings to PAN-OS system, GlobalProtect, and IdP logs.
references:
- https://thehackernews.com/2026/10/qilin-and-inc-ransomware-groups-exploit.html
- https://attack.mitre.org/techniques/T1133/
author: Security Arsenal
date: 2026/10/30
tags:
- attack.initial_access
- attack.t1133
logsource:
product: panos
service: globalprotect
detection:
selection_vpn_success:
event_type|contains:
- 'globalprotect'
- 'vpn'
action|contains:
- 'login'
- 'auth'
- 'tunnel'
outcome|contains:
- 'success'
- 'established'
filter_mfa_success:
mfa_result|contains:
- 'success'
- 'approved'
- 'push_accepted'
condition: selection_vpn_success and not filter_mfa_success
falsepositives:
- MFA logs forwarded to a different index or delayed by ingestion
- Legacy service accounts excluded from MFA and documented in policy
level: high
---
title: New or Rare Source Establishing PAN-OS VPN Tunnel Followed by Privileged Internal Access
id: 5d4a7f0d-0f6a-44df-9c6b-21c0d4aa8c44
status: experimental
description: Detects VPN logons from previously unseen public IPs or unusual geographies followed by privileged internal authentication to sensitive infrastructure. Intended to catch post-bypass ransomware access behavior.
references:
- https://thehackernews.com/2026/10/qilin-and-inc-ransomware-groups-exploit.html
- https://attack.mitre.org/techniques/T1078/
- https://attack.mitre.org/techniques/T1021/
author: Security Arsenal
date: 2026/10/30
tags:
- attack.valid_accounts
- attack.lateral_movement
- attack.t1078
- attack.t1021
logsource:
category: authentication
product: windows
detection:
selection_internal_auth:
LogonType:
- 3
- 10
AuthenticationPackageName:
- 'NTLM'
- 'Kerberos'
TargetUserName|contains:
- 'admin'
- 'svc'
- 'backup'
selection_sensitive_host:
ComputerName|contains:
- 'DC'
- 'BKUP'
- 'VEEAM'
- 'SQL'
- 'HYPERV'
condition: selection_internal_auth and selection_sensitive_host
falsepositives:
- Administrators working over VPN during maintenance windows
- Backup service accounts with scheduled authentication
level: medium
---
title: Firewall Management Plane Access Immediately After VPN Session Establishment
id: 1b2c9d6e-2b91-4a83-9d4d-4b7c0b2a7f31
status: experimental
description: Detects administrative access to firewall, Panorama, or adjacent management infrastructure shortly after a VPN tunnel is created. Useful where attackers use the bypassed VPN session to reach internal management interfaces.
references:
- https://thehackernews.com/2026/10/qilin-and-inc-ransomware-groups-exploit.html
- https://attack.mitre.org/techniques/T1133/
- https://attack.mitre.org/techniques/T1078/
author: Security Arsenal
date: 2026/10/30
tags:
- attack.initial_access
- attack.valid_accounts
- attack.t1133
- attack.t1078
logsource:
category: network_connection
product: windows
detection:
selection_mgmt_ports:
DestinationPort:
- 22
- 443
- 3389
- 5985
- 5986
selection_mgmt_hosts:
DestinationIp|cidr:
- '10.0.0.0/8'
- '172.16.0.0/12'
- '192.168.0.0/16'
selection_vpn_pool_source:
SourceIp|cidr:
- '10.250.0.0/16'
condition: selection_mgmt_ports and selection_mgmt_hosts and selection_vpn_pool_source
falsepositives:
- Replace the example VPN pool CIDR with your real GlobalProtect/Prisma Access pool
- Expected admin jump-host traffic
level: high
// Hunt PAN-OS/Prisma Access CEF or Syslog for successful VPN/tunnel events that lack a nearby MFA success.
// Adjust DeviceVendor/DeviceProduct strings, Activity names, and ExtendedProperties keys to your ingestion mapping.
let lookback = 14d;
let mfa_window = 10m;
let vpn = CommonSecurityLog
| where TimeGenerated > ago(lookback)
| where DeviceVendor =~ "Palo Alto Networks" or DeviceProduct has_any ("PAN-OS","Prisma Access","GlobalProtect")
| where Activity has_any ("login","auth","tunnel","globalprotect") or Message has_any ("GlobalProtect","tunnel established","auth success")
| extend User = coalesce(SourceUserName, DestinationUserName, extract(@"user=([^;\s]+)", 1, Message))
| extend Src = coalesce(SourceIP, extract(@"src=([0-9a-fA-F:\.]+)", 1, Message))
| extend VpnResult = coalesce(Activity, Message)
| project VpnTime=TimeGenerated, User, Src, VpnResult, Message, DeviceProduct, Computer;
let mfa = CommonSecurityLog
| where TimeGenerated > ago(lookback)
| where Message has_any ("mfa","push","duo","okta","radius","challenge","approved","success") or AdditionalExtensions has_any ("mfa","duo","okta")
| extend User = coalesce(SourceUserName, DestinationUserName, extract(@"user=([^;\s]+)", 1, Message))
| extend Src = coalesce(SourceIP, extract(@"src=([0-9a-fA-F:\.]+)", 1, Message))
| project MfaTime=TimeGenerated, User, Src, MfaMessage=Message;
vpn
| where isnotempty(User) and isnotempty(Src)
| join kind=leftouter mfa on User, Src
| where isempty(MfaTime) or abs(datetime_diff("minute", VpnTime, MfaTime)) > mfa_window
| summarize Events=count(), FirstSeen=min(VpnTime), LastSeen=max(VpnTime), Samples=make_list(VpnResult, 5) by User, Src, DeviceProduct
| order by LastSeen desc;
-- Velociraptor hunt for endpoints showing suspicious access patterns after a perimeter VPN compromise.
-- Scope to systems reachable from GlobalProtect/Prisma Access pools; replace pool regex and admin tool names for your environment.
LET vpn_pool_regex = '^(10\.250\.|192\.168\.50\.)'
LET suspicious_tools = '(psexec|wmic|powershell|rclone|vssadmin|bcdedit|wevtutil|net\.exe|nltest|adfind|sharpwmi|rustdesk|anydesk|screenconnect)'
SELECT Pid,
Name,
Exe,
CommandLine,
Username,
CreateTime,
netstat().LocalAddr AS LocalAddr,
netstat().RemoteAddr AS RemoteAddr,
netstat().RemotePort AS RemotePort,
netstat().Status AS ConnStatus
FROM pslist()
WHERE (CommandLine =~ suspicious_tools OR Exe =~ suspicious_tools)
OR (netstat().RemoteAddr =~ vpn_pool_regex AND netstat().RemotePort in (22,135,139,445,3389,5985,5986))
ORDER BY CreateTime DESC
#!/usr/bin/env bash
# Verify/harden PAN-OS edge posture for CVE-2026-0257 triage.
# Requires: curl, jq, PAN-OS API key with read rights, and exact fixed-build list from Palo Alto advisory.
set -euo pipefail
FW_HOST="${FW_HOST:-panorama-or-fw.example.local}"
API_KEY="${API_KEY:?set API_KEY}"
ALLOWED_VPN_SRC="${ALLOWED_VPN_SRC:-203.0.113.0/24,198.51.100.0/24}"
BASE="https://${FW_HOST}/api/?type=op&key=${API_KEY}"
echo "[+] Retrieving PAN-OS version"
curl -sk "${BASE}&cmd=%3Cshow%3E%3Csystem%3E%3Cinfo%3E%3C%2Finfo%3E%3C%2Fsystem%3E%3C%2Fshow%3E" | tee /tmp/panos_system_info.xml
echo "[+] Review advisory fixed releases before continuing: https://security.paloaltonetworks.com/"
echo "[!] Do not rely on this script for the CVE-2026-0257 fixed-build matrix."
echo "[+] Active GlobalProtect/remote sessions snapshot"
curl -sk "${BASE}&cmd=%3Cshow%3E%3Cglobal-protect-gateway%3E%3Ccurrent-user%3E%3C%2Fcurrent-user%3E%3C%2Fglobal-protect-gateway%3E%3C%2Fshow%3E" | tee /tmp/gp_current_users.xml
echo "[+] Fail if VPN source policy is broad; replace with CLI/API audit for your config model"
if [[ "${ALLOWED_VPN_SRC}" == "0.0.0.0/0" || "${ALLOWED_VPN_SRC}" == "any" ]]; then
echo "[CRITICAL] VPN source restrictions appear permissive; restrict portal/gateway exposure and IdP conditional access immediately." >&2
exit 2
fi
echo "[+] Next steps: patch to vendor-fixed PAN-OS/Prisma Access release, revoke active sessions, rotate exposed credentials, and hunt 14-30 days back."
Remediation
- Patch immediately using the exact fixed releases listed in Palo Alto Networks’ advisory for CVE-2026-0257. Do not infer fixed versions from secondary reporting; enumerate every PAN-OS firewall, Panorama-managed deployment, and Prisma Access tenant against the vendor matrix.
- Treat unpatched exposure as an incident. If the VPN portal was internet reachable before patching, force session invalidation, rotate credentials that could have authenticated through the edge, and review IdP/RADIUS/MFA logs for impossible travel, device-code anomalies, and MFA gaps.
- Restrict attack surface while patching: limit GlobalProtect/Prisma Access source ranges where business feasible, enforce IdP conditional access independent of the firewall, disable unused portals/gateways, and ensure management interfaces are never reachable from VPN pools.
- Hunt backward at least 14–30 days for authentication success without MFA, first-seen source IPs, and VPN-originated access to domain controllers, backup platforms, hypervisors, and security tooling.
- Validate MFA cryptographically and operationally. Confirm the firewall is not accepting fallback paths such as RADIUS without MFA, local accounts, legacy auth, or split configuration between portal and gateway.
- Add detections to your managed SOC runbooks for PAN-OS CEF/Syslog, IdP sign-in logs, Windows authentication, EDR process execution, and backup-control-plane access. The remediation clock should assume ransomware affiliates are scanning for patched-but-unrestarted, partially upgraded, or misconfigured deployments.
Related Resources
Security Arsenal Managed SOC Services AlertMonitor Platform Book a SOC Assessment soc-mdr Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.