Palo Alto VPN Bypass Exploited for Months as Security Flaws Hit MSP Infrastructure
Ransomware groups exploited a patched Palo Alto Networks VPN vulnerability for four months, while similar trust failures surfaced in ConnectWise infrastructure.
Palo Alto VPN Bypass Exploited for Months as Security Flaws Hit MSP Infrastructure
Ransomware groups exploited a patched Palo Alto Networks VPN vulnerability for four months, while similar trust failures surfaced in ConnectWise infrastructure.
Palo Alto VPN Vulnerability Exploited
Ransomware operators have spent roughly four months monetizing a critical authentication bypass in Palo Alto Networks GlobalProtect VPN software. Although the vulnerability was patched in May, Unit 42 reported on October 19 that the threat actors behind the Spikey Scorpius, also known as Qilin, and Tarnished Scorpius, or INC, ransomware groups were actively exploiting the flaw to gain initial network access. Public reporting on the extent of this campaign emerged on October 21.
The vulnerability, tracked as CVE-2026-0257, carries a CVSS score of 7.8 and stems from a failure in how the GlobalProtect portal and gateway handle authentication override cookies. According to the Palo Alto Networks advisory, the root cause involves reliance on cookies without proper validation or integrity checking. Attackers can retrieve a public encryption certificate from a target gateway, use it to encrypt a forged authentication override cookie, and the device will implicitly trust the cookie.
This grants unauthorized VPN access, effectively bypassing multi-factor authentication because the session is established using a trusted cookie. The timeline of exploitation began shortly after the patch was released on May 13, 2026, when the vulnerability was also added to the CISA Known Exploited Vulnerability catalog.
Sophisticated Post-Access Behavior
While the vendor initially acknowledged limited exploit attempts, Rapid7 observed distinct waves of activity targeting local administrator accounts on May 17 and May 21. Unit 42 investigations have traced these intrusions back to early June, affecting sectors including healthcare, education, government, and energy.
Once inside, attackers have demonstrated sophisticated post-access behavior. Andy Piazza, Senior Director of Threat Intelligence at Unit 42, noted that attackers are leveraging this vulnerability to gain an initial foothold into corporate networks, subsequently bypassing multi-factor authentication controls to establish a VPN session.
In some instances, actors pivoted directly to the virtualization layer, moving from the VPN gateway to the vCenter management appliance. By disabling security controls on ESXi hypervisors and using custom tools for offline credential dumping against domain controller virtual disks, these actors bypassed in-guest endpoint detection and response controls.
Impact on Managed Service Provider Infrastructure
ReliaQuest, which also tracked activity from groups like Qilin and Settra, warned that because this access originates through an organization's own VPN, the activity can mimic legitimate remote work. This pattern of identity-based compromise has also impacted the managed service provider infrastructure core.
ConnectWise identified unauthorized access to application identities within its Cloud Backup environment. Unlike the Palo Alto incident, which involved forged authentication override cookies, this involved compromised Entra workload identities rather than individual user passwords.
ConnectWise disabled seven application identities on October 17 and revoked the certificates behind the affected application connections, warning that previously issued access tokens may remain usable.
About The Author
