Blog
GlobalProtect footholds after CVE-2026-0257: what to hunt before you move on
CVE-2026-0257 is an authentication bypass in Palo Alto Networks PAN-OS GlobalProtect. Unit 42 linked post-exploitation activity to ransomware operators. This post covers the vulnerability mechanics, lateral movement paths from VPN footholds, and the hunt artifacts that matter for your engagement report.
Edge & VPN · Operator triage
CVE-2026-0257 is an authentication bypass in the Palo Alto Networks PAN-OS GlobalProtect gateway and portal. Unit 42's threat brief describes active exploitation by ransomware operators who are using the VPN foothold as an initial access vector before moving to internal networks. The PAN-OS security advisory carries patch information.
Vulnerability mechanics
| Field | Value |
|---|---|
| CVE | CVE-2026-0257 |
| Product | Palo Alto Networks PAN-OS (GlobalProtect gateway / portal) |
| Class | Authentication bypass |
| Attack vector | Network (internet-facing) |
| Auth required | None |
| Impact | Unauthenticated access to GlobalProtect VPN — establishes VPN session as arbitrary user |
| Unit 42 observed post-exploitation | Ransomware staging, credential dumping, lateral movement |
The bypass allows an unauthenticated attacker to obtain a valid GlobalProtect VPN session without supplying correct credentials. From the network's perspective, the connection appears as a legitimate VPN client — it enters through the same network path as authorised remote users, with access to the internal network segments the GlobalProtect gateway is configured to route.
VPN foothold to lateral movement paths
Loading diagram…
Ransomware operator TTPs (Unit 42 observations)
Unit 42's analysis documents the following post-exploitation sequence in observed intrusions:
- Initial access: CVE-2026-0257 exploited to establish a VPN session.
- Reconnaissance: LDAP queries for domain users, privileged groups, and computer accounts. Net command or BloodHound-equivalent tooling used to map AD structure.
- Credential capture: Kerberoasting against service accounts; credential dumping from compromised hosts using LSASS memory reading tools.
- Lateral movement: RDP and WMI used to reach additional hosts. SMB for file staging.
- Persistence: Scheduled tasks and service installations on multiple hosts before ransomware deployment.
- Ransomware staging: Payload distributed via SMB shares or Group Policy abuse; detonated across multiple hosts simultaneously.
Hunt artifacts
| Artifact | Location | What it indicates |
|---|---|---|
| GlobalProtect session from unusual source IP | PAN-OS traffic logs, GlobalProtect system logs | Exploit or unauthorized access |
| VPN pool IP conducting LDAP queries | DC event logs (ID 1644), network capture | Reconnaissance from VPN foothold |
| Kerberos TGS requests for service accounts | DC Security log (Event ID 4769) — encryption type 0x17 (RC4) | Kerberoasting in progress |
| LSASS memory access from non-OS process | EDR / Sysmon Event ID 10 | Credential dumping attempt |
| Scheduled task creation via WMI or schtasks | Windows Security log (Event ID 4698, 4702), Sysmon | Persistence installation |
| Volume shadow copy deletion | Windows Security log / application log, VSS event log | Pre-ransomware anti-recovery |
| Unusual SMB write activity to multiple hosts | SMB audit logs, network flow data | Ransomware staging / lateral file copy |
| PAN-OS globalprotect.log auth entries without corresponding RADIUS/LDAP success | PAN-OS system logs | Authentication bypass evidence |
Operator sequencing
If GlobalProtect is in scope and an unpatched PAN-OS version is confirmed:
- Identify PAN-OS version from the management interface (Device > Software) or via HTTP response headers on the portal (
/global-protect/login.esp). Compare against the patched releases in the security advisory. - Confirm GlobalProtect gateway/portal exposure — these are separate PAN-OS roles. The advisory specifies which configurations are affected.
- Test authentication bypass — the advisory or supporting PoC describes the specific request parameter or sequence that triggers the bypass. Capture the full HTTP request/response as primary evidence.
- If a VPN session is established, document the internal IP assigned, accessible network segments, and any AD/DNS enumeration results as secondary findings.
- Hunt the artifact list above if you have log access — corroborate that exploitation is either not present or has already occurred.
Patch applies to specific PAN-OS versions. Verify the exact affected/patched version matrix in the PAN-OS advisory before assessing applicability.