CVE-2026-0257: Qilin and Inc exploit GlobalProtect for network access
Unit 42 updated its observations of ransomware operators exploiting CVE-2026-0257 in GlobalProtect. This report separates configuration conditions, post-access activity and Vietnam verification limits.
Updated: · Vietnam time (UTC+7)
Publications from Unit 42, Palo Alto Networks and Rapid7 are verified. Unit 42 says it observed operators associated with Qilin and Inc; Settra is referenced only through public reporting. No reviewed primary source confirmed an affected organization in Vietnam.
[S1] is Unit 42's 20 October update; [S2] is the product advisory; [S3] is Rapid7's earlier MDR scope. Observations from different dates are not merged into one incident. Exposure or an IOC is not proof of compromise. Artwork is illustrative.
Evidence: two ransomware clusters observed by Unit 42
In its 20 October update, Unit 42 said it continued to observe exploitation attempts from operators it tracks as Spikey Scorpius, associated with Qilin, and Tarnished Scorpius, associated with Inc. The report mentions Settra only through public reporting, not as a direct Unit 42 observation. [S1]
CVE-2026-0257 is an authentication-bypass issue in a GlobalProtect portal or gateway when a specific configuration combination is enabled. The product advisory marks the issue as exploited and directs customers to patches or the documented mitigation. [S2]
Evidence: configuration determines exposure
Palo Alto Networks says exposure depends on authentication override cookies being enabled with a related certificate configuration. Panorama and Cloud NGFW are outside the published affected scope. [S2]
Operators should compare exact versions, configuration and vendor guidance. An internet-facing GlobalProtect endpoint should not automatically be treated as exploitable through this path.
Evidence: post-access activity can reach ESXi
Unit 42 describes successful VPN access followed by internal discovery, RMM tooling, RDP or SMB movement, credential collection, exfiltration and ransomware deployment. In one investigated case, the actor pivoted to vCenter, altered an execution control on ESXi and accessed a domain-controller VMDK; the report also describes chaining Veeam CVE-2023-27532. [S1]
This is an incident-response observation within Unit 42's scope, not a claim that every organization exposed to CVE-2026-0257 experienced the complete chain.
Historical evidence: Rapid7's May scope
Rapid7 previously observed forged cookies and successful VPN sessions in two of ten affected MDR customers it reviewed; within that earlier time and scope, it did not identify lateral movement. [S3]
This does not contradict the later ransomware update. It shows why technical reporting must retain the date, customer set and evidence actually available to each source.
Technical assessment: priority actions
- Apply the patch; if that is not yet possible, use the vendor's mitigation for authentication override and certificate configuration.
- Check whether a management interface was unintentionally exposed through a GlobalProtect profile or unexpected administrative port.
- Review successful VPN sessions, credential changes, newly observed RMM, RDP or SMB activity and access to vCenter, ESXi or Veeam.
- Preserve logs and build a timeline before attributing the incident to a ransomware family.
Vietnam scope
No primary source reviewed on 21 October confirmed exploitation or ransomware impact at a Vietnamese organization through this CVE. Victims are not inferred from exposed IP addresses or scanning activity.
Sources
Each source's scope and date are recorded separately when available. A citation does not independently verify every assessment.
Update history
· Published VI/EN coverage from Unit 42 and two product or MDR advisories, separating configuration conditions, observation dates and Vietnam limits, with six event-specific images.
Corrections policy
