Published on October 20, 2026
Hackers Exploit Palo Alto VPN Flaw to Bypass MFA and Steal Credentials from VMware Disks
Severity
High
Detail
Researchers from Palo Alto Networks Unit 42 reported active exploitation of CVE-2026-0257, a vulnerability affecting certain GlobalProtect portal and gateway deployments. The flaw can allow threat actors to bypass multi-factor authentication (MFA) under specific configurations and gain unauthorized VPN access to targeted environments.
According to the investigation, threat actors linked to the Qilin and Inc ransomware operations have leveraged the vulnerability to gain initial access to organizations across multiple sectors, including healthcare, education, financial services, manufacturing, government, and energy. Following successful access, attackers conducted lateral movement, credential theft, data exfiltration, and ransomware deployment activities.
In one observed incident, attackers pivoted from a compromised VPN gateway to a VMware vCenter environment, disabled security controls on ESXi hosts, and extracted credentials directly from a domain controller’s virtual disk (VMDK). This technique enabled credential theft without interacting with the operating system, bypassing endpoint security controls deployed within the virtual machine.
How?
The vulnerability affects GlobalProtect deployments where authentication override cookies are enabled alongside a vulnerable certificate configuration. Attackers can forge authentication override cookies by exploiting improper validation mechanisms and may subsequently establish VPN sessions without completing normal authentication and MFA requirements.
After gaining VPN access, threat actors use remote management tools, Remote Desktop Protocol (RDP), and Server Message Block (SMB) services to move throughout the environment. In observed cases, attackers targeted virtualization infrastructure, including VMware vCenter and ESXi hosts, to obtain credentials, maintain persistence, and prepare systems for ransomware deployment.
The credential theft technique involved extracting credentials directly from virtual disk files rather than from within the operating system, reducing the likelihood of detection by endpoint security solutions.
Indicators of Compromise (IoCs)
| IOC Type | Indicator | Description |
| IP Address | 104.207.144[.]154 | Suspicious source IP observed during exploitation |
| IP Address | 146.19.216[.]125 | Suspicious source IP observed during exploitation |
| Device Name | GP-CLIENT | Observed client device name |
| Device Name | DESKTOP-GP01 | Observed client device name |
| Host ID | aa:bb:cc:dd:ee:ff | Host identifier associated with suspicious activity |
| Host ID | 00:11:22:33:44:55 | Host identifier associated with suspicious activity |
| Log Event | gateway-connected | Successful VPN connection event that may indicate exploitation |
Conclusion
This activity demonstrates how a VPN authentication bypass can serve as an effective entry point for ransomware operations. Organizations running affected Palo Alto Networks GlobalProtect deployments may face risks including unauthorized access, credential compromise, lateral movement, data theft, and ransomware deployment.
Organizations should immediately review the vendor advisory, upgrade affected GlobalProtect portals and gateways, investigate suspicious VPN connection activity, and monitor virtualized environments for unauthorized administrative actions. Where immediate patching is not possible, organizations should consider disabling authentication override functionality or replacing affected certificates as recommended by the vendor.
Source