Threat reportVulnerabilityTL-2026-3657
PAN-OS GlobalProtect/Prisma Access Authentication Bypass CVE-2026-0257 Exploited by Qilin and Settra Ransomware (ThreatsDay Bulletin: SiteGuard WAF CVE-2026-106931, Adobe AEM RCE Chain, Noir Wallet Drainer)
PAN-OS GlobalProtect/Prisma Access Authentication Bypass (TL-2026-3657), also tracked as GlobalProtect authentication override cookie forgery, is a critical-severity software vulnerability scored CVSS 7.8, first published 2026-10-15. It is attributed to Qilin with medium confidence, affects Palo Alto Networks PAN-OS GlobalProtect portal/gateway, references 10 CVEs (CVE-2026-0257, CVE-2026-106931, CVE-2026-110392), maps to 13 MITRE ATT&CK techniques (T1021.002, T1036.005, T1053.005), and is covered by 9 detection rules and 21 indicators of compromise.
- CVSS
- 7.8/10Critical
- CVEs
- 10Referenced vulnerabilities
- Techniques
- 13MITRE ATT&CK
- Actors
- 2Qilin
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 21Indicators of compromise
Key facts for TL-2026-3657
- Threat ID
- TL-2026-3657
- Also known as
- GlobalProtect authentication override cookie forgery
- Severity
- CRITICAL
- CVSS
- 7.8 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:N/E:A/AU:N/R:A/V:D/RE:M/U:Red)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution
- Qilin, Settra ransomware operators
- Attribution confidence
- MEDIUM
- Motivation
- FINANCIAL
- Target sectors
- technology, finance, health, manufacturing, retail, consumer services
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 21
Malware and tooling in PAN-OS GlobalProtect/Prisma Access Authentication Bypass
Malware and tooling: AgendaCrypt, BotHelper RAT, Cobalt Strike, Noir, Settra, SharpHound, BloodHound - S0521, Cobalt Strike, Impacket - S0357, Rapid7
How PAN-OS GlobalProtect/Prisma Access Authentication Bypass works
CVE-2026-0257, a forged authentication-override-cookie bypass in Palo Alto Networks PAN-OS GlobalProtect and Prisma Access, is being used by the Qilin and Settra ransomware operations to obtain unauthorized VPN sessions, roughly 149 days after the 2026-05-13 patch. The same 2026-10-15 Hacker News bulletin reports in-the-wild exploitation of EG Secure SiteGuard Server Edition CVE-2026-106931 and covers an Adobe AEM RCE chain, the Noir wallet drainer and several RATs and infostealers.
CVE-2026-0257 (CWE-565, CVSS 4.0 score 7.8; Palo Alto Networks raised it from 4.7 after Rapid7 published a working proof of concept on 2026-05-29) affects the GlobalProtect portal and gateway on PAN-OS 12.1, 11.2, 11.1 and 10.2 and on Prisma Access 11.2 and 10.2. Cloud NGFW and Panorama are not affected. Exploitation needs three conditions: GlobalProtect portal or gateway enabled, authentication override cookies enabled (non-default), and the certificate that protects those cookies reused for another exposed service such as the public HTTPS portal. An unauthenticated remote attacker can retrieve the public certificate, forge an authentication override cookie for an arbitrary user, and establish a GlobalProtect VPN session without valid credentials. The session looks like a legitimate remote-access connection, which helps the attacker blend in.
Palo Alto Networks published the advisory on 2026-05-13 and the first exploit attempts were seen on 2026-05-17, with a second wave on 2026-05-21 that Rapid7 assessed as the same actor. The flaw was added to CISA KEV on 2026-05-29 (federal deadline 2026-06-01). Arctic Wolf reported increased exploitation in early June and documented forged administrator credentials, rapid configuration retrieval, IPsec tunnel establishment and lateral movement with Impacket and NTLM relay, from VPN clients with the hostname 'kali'. In October 2026 ReliaQuest reported that multiple groups, including the Qilin ransomware-as-a-service operation (active since 2022) and Settra (first seen June 2026), were exploiting the flaw against unpatched devices. Secondary reporting says operators then deployed Cobalt Strike, BloodHound and SharpHound for Active Directory mapping, and moved through Windows admin shares toward domain-wide encryption. ReliaQuest assessed that exploitation was highly likely to continue over the next three months. Unit 42 is credited in the bulletin for PAN-OS exploitation reporting.
The source bulletin (The Hacker News, 2026-10-15) also covers: in-the-wild exploitation of a command injection in EG Secure SiteGuard Server Edition (CVE-2026-106931, CVSS 8.5, v2.20+); an unauthenticated four-flaw RCE chain in Adobe Experience Manager Cloud (DAM import, XSS, unsafe XML handling, Groovy execution, since patched); Samsung QA-Board CVE-2026-110392 (CVSS 9.8, unauthenticated RCE); Channel Software WebAlliance eCommerce CVE-2026-108065 (CVSS 9.8 SQL injection, no patch announced); NSD DNS server code-execution flaws CVE-2026-101337/101338/101339/101341 (fixed in 4.15.3+); NVIDIA Linux GPU driver CVE-2026-47595 'Bad UVM' container escape; Xen grant-table race CVE-2026-79610; the Noir wallet drainer, which resolves its backend through DNS TXT records over DoH; and the CikaBika Bot, KGB RAT, BotHelper RAT, XWorm, Warden Stealer, Aoki and CastleStealer malware families. CVE-2026-106931, CVE-2026-110392 and the Adobe chain could not be independently confirmed outside the bulletin during this research and should be treated as single-source. The Qilin/Settra attacker IPs from Arctic Wolf (June 2026 activity) and from a secondary October write-up differ and are recorded separately with their provenance.
MITRE ATT&CK techniques used in TL-2026-3657
Lateral Movement
T1021.002 SMB/Windows Admin Shares
Defense Evasion
T1036.005 Match Legitimate Resource Name or Location
Persistence
Discovery
T1069.002 Domain Groups; T1087.002 Domain Account
Command and Control
Initial Access
T1078 Valid Accounts; T1133 External Remote Services; T1190 Exploit Public-Facing Application
Collection
lateral-movement
Credential Access
defense-impairment
Affected products and versions in PAN-OS GlobalProtect/Prisma Access Authentication Bypass
- Palo Alto Networks — PAN-OS GlobalProtect portal/gateway
Vulnerable versions: 12.1 < 12.1.4-h6; 12.1 < 12.1.7; 11.2 < 11.2.4-h17; 11.2 < 11.2.7-h14; 11.2 < 11.2.10-h7; 11.2 < 11.2.12; 11.1 < 11.1.15; 10.2 < 10.2.18-h6
Fixed in: 12.1.4-h6; 12.1.7; 11.2.4-h17; 11.2.7-h14; 11.2.10-h7; 11.2.12; 11.1.15; 10.2.18-h6 - Palo Alto Networks — Prisma Access
Vulnerable versions: 11.2.0 < 11.2.7-h13; 10.2.0 < 10.2.10-h36
Fixed in: 11.2.7-h13; 10.2.10-h36 - EG Secure Solutions — SiteGuard Server Edition (WAF)
Vulnerable versions: 2.20 and later per bulletin - Samsung — QA-Board
Vulnerable versions: per bulletin: unauthenticated RCE (CVE-2026-110392) - Channel Software — WebAlliance eCommerce
Vulnerable versions: all per bulletin (no patch announced) - NLnet Labs — NSD DNS Server
Vulnerable versions: before 4.15.3
Fixed in: 4.15.3
Remediation for PAN-OS GlobalProtect/Prisma Access Authentication Bypass
Patches
- Palo Alto Networks advisory CVE-2026-0257 (published 2026-05-13, updated 2026-06-03)
- NSD 4.15.3 or later for CVE-2026-101337/101338/101339/101341
Immediate actions
- Upgrade PAN-OS and Prisma Access to fixed builds (for example 12.1.4-h6/12.1.7, 11.2.4-h17/11.2.7-h14/11.2.10-h7/11.2.12, 11.1.15, 10.2.18-h6)
- Disable GlobalProtect authentication override cookies, or generate a dedicated certificate used only for authentication override and never reuse the portal or gateway certificate
- Terminate active GlobalProtect sessions and review VPN logs for clients with hostnames such as kali, parrot or pentest-vm
- Block the listed attacker IPs at the perimeter and hunt EDR for BloodHound.exe, SharpHound.exe, Impacket and Cobalt Strike activity
Workarounds
- During phased upgrades use: set global-protect enable-auth-override-cookie-hmac no, then re-enable it (yes) after full deployment; users must re-authenticate once after upgrade
- Review EG Secure SiteGuard Server Edition for the vendor fix for CVE-2026-106931 (not independently verified)
Longer-term hardening
- Restrict GlobalProtect portal and gateway exposure to trusted IP ranges where feasible
- Enforce MFA for administrative accounts and monitor for NTLM relay
- Alert on VPN-assigned IPs that immediately enumerate Active Directory or access admin shares
CVEs associated with PAN-OS GlobalProtect/Prisma Access Authentication Bypass
CVE-2026-0257, CVE-2026-106931, CVE-2026-110392, CVE-2026-108065, CVE-2026-47595, CVE-2026-101341, CVE-2026-101339, CVE-2026-101338, CVE-2026-101337, CVE-2026-79610
Weaknesses (CWE) in PAN-OS GlobalProtect/Prisma Access Authentication Bypass
Timeline of PAN-OS GlobalProtect/Prisma Access Authentication Bypass
- Palo Alto Networks publishes advisory and patches for CVE-2026-0257 (GlobalProtect/Prisma Access authentication override cookie bypass)
- Earliest exploitation attempts against CVE-2026-0257 observed (Rapid7)
- Second exploitation wave observed, assessed as the same actor; VPN sessions with assigned IPs established in two cases
- Rapid7 publishes technical analysis and working PoC; Palo Alto Networks confirms active exploitation and raises CVSS from 4.7 to 7.8; CISA adds CVE-2026-0257 to KEV
- CISA remediation deadline for federal agencies
- Palo Alto Networks updates the advisory with the ATTACKED status and CVSS 4.0 vector
- Arctic Wolf reports increased exploitation with Impacket/NTLM relay lateral movement and publishes attacker IPs
- ReliaQuest reports Qilin and Settra ransomware operations exploiting CVE-2026-0257, about 149 days after the patch; Infoblox publishes Noir wallet drainer research the same day
- The Hacker News ThreatsDay bulletin covers CVE-2026-0257 ransomware exploitation, SiteGuard WAF CVE-2026-106931 in-the-wild exploitation and related items
Sources cited for PAN-OS GlobalProtect/Prisma Access Authentication Bypass
- ThreatsDay Bulletin - The Hacker News
- Palo Alto Networks Security Advisory CVE-2026-0257
- PAN-OS GlobalProtect Authentication Bypass Exploited - The Hacker News
- Arctic Wolf Security Bulletin: CVE-2026-0257 PAN-OS GlobalProtect Authentication Bypass
- Palo Alto GlobalProtect VPN Auth Bypass Flaw Now Exploited in Attacks - BleepingComputer
- ReliaQuest Threat Research: Qilin and Settra exploiting CVE-2026-0257
- CVE-2026-0257: GlobalProtect VPN Flaw Hit by Ransomware - OpenVPN Blog
- CVE-2026-0257: GlobalProtect VPN Exploited by Qilin and Settra - Decryption Digest
- Active Exploitation of PAN-OS GlobalProtect Auth Bypass Flaw - Ampcus Cyber (Rapid7 PoC summary)
- Noir Wallet Drainer Uses DNS to Keep Fake Crypto Pages Working - GridinSoft (Infoblox findings)
- BotHelper RAT gives attackers live Windows screen access
Detection coverage for TL-2026-3657
As of 2026-10-15, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3657 across Splunk SPL, Microsoft KQL and Sigma, covering 21 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-3657
2 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.