CVE-2026-0257 Ransomware vCenter Attacks: Why Patching PAN-OS Isn't the Finish Line

CVE-2026-0257, a PAN-OS GlobalProtect authentication bypass patched by Palo Alto Networks earlier in 2026, is being actively exploited by the Qilin and Inc ransomware groups to bypass MFA, pivot off compromised firewalls, and attack VMware vCenter and ESXi hypervisors directly, a path that leaves most endpoint detection tools blind.

Key takeaways

• CVE-2026-0257 is a PAN-OS GlobalProtect authentication bypass exploited through forged override cookies, which lets an attacker skip MFA entirely, according to CyCognito's writeup.
• Help Net Security reports that ransomware crews have been exploiting this bug since June 2026, well before most organizations treated it as urgent.
• Qilin and Inc are now pivoting past the firewall into VMware vCenter and ESXi and pulling credentials directly off virtual disks, per Cybersecurity News and Cyberpress.
• A patched PAN-OS firewall does not undo a session, token, or credential an attacker already harvested, which is why Unit42's updated threat brief still describes active, ongoing exploitation.

What is CVE-2026-0257?

CVE-2026-0257 is a PAN-OS GlobalProtect authentication bypass vulnerability that lets an attacker forge override cookies and walk past the GlobalProtect portal's multi-factor authentication step without ever supplying a valid second factor, as detailed in CyCognito's analysis. Palo Alto Networks shipped a fix earlier in 2026, and The Hacker News covered active exploitation attempts shortly after.

That timeline matters. Proof-of-concept exploit code has been publicly available on GitHub for months, and Help Net Security's reporting puts the earliest confirmed ransomware exploitation back in June 2026. Any organization that patched late, or patched the firewall but did nothing about sessions and credentials that were already stolen, may still be compromised today.

What did Qilin and Inc ransomware actually do?

Qilin and Inc are two separate ransomware operations that, according to Cyberpress and Codekeeper's reporting, both used CVE-2026-0257 to get past GlobalProtect's authentication and skip MFA outright. From there, instead of chasing individual endpoints, they went straight for VMware infrastructure, lifting credentials directly off virtual disks, per Cybersecurity News.

That is a deliberate target choice, not an afterthought. A hypervisor holds the file systems for every virtual machine it runs. Disable or encrypt the management plane at the ESXi or vCenter level, and the backup server, the domain controller, and the file server all go down in a single action, without a single endpoint agent ever firing an alert.

Unit42's threat brief, last updated 20 October 2026, confirms this is not an isolated incident but ongoing activity adopted by multiple affiliates, and Cybersecurity Dive's coverage describes the targeting as expanding, not slowing down.

Why doesn't patching PAN-OS end the intrusion?

Patching PAN-OS closes the door an attacker used to get in. It does nothing about who already walked through it before the patch landed. eSecurity Planet's checklist makes exactly this point: organizations need to treat CVE-2026-0257 as a post-compromise event, not a patch-and-close-the-ticket item, because sessions and credentials harvested beforehand remain valid afterward.

If an attacker already pivoted from the VPN into vCenter before anyone applied the fix, patching GlobalProtect is irrelevant to that attacker's current foothold. They stopped needing the VPN the moment they got inside. From there, they're operating with legitimate administrative credentials that generate logs indistinguishable, at a glance, from routine hypervisor administration.

Why can't EDR see what happens next?

ESXi and vCenter don't run a standard endpoint agent. CrowdStrike Falcon, Microsoft Defender, SentinelOne, every major EDR platform protects the operating systems running inside a virtual machine, not the hypervisor's own management plane. None of them sit inside vCenter watching for an unfamiliar admin login or a mass datastore operation.

That means ransomware deployed at the hypervisor layer can encrypt every VM on a host without generating a single EDR detection, because there is no agent positioned to see it happen. This isn't an evasive technique in the usual sense. It's an attacker simply operating one layer below where endpoint tooling is built to look, the same structural blind spot we've described in our coverage of hypervisor-layer rootkit activity.