Ransomware Crews Are Logging In Through the VPN, and Patching It Does Not Log Them Out

The remote access gateway exists to answer one question: is this person allowed in? This month, two of the most widely deployed gateways answered it wrongly for people who never held a password. Ransomware operators are now opening VPN sessions through an authentication bypass in Palo Alto Networks GlobalProtect, while a separate maximum-severity flaw in SonicWall's SMA1000 remote access appliances drew attack traffic within days of its fix. The uncomfortable detail for network teams is what happens after the patch: a session the attacker opened before the upgrade can stay open after it, looking exactly like an employee working from home.

A Front Door That Accepts a Forged Key

According to Cyber Security News, reporting ReliaQuest's threat research on October 11, the Qilin and Settra ransomware groups are exploiting CVE-2026-0257 to create unauthorized VPN sessions on PAN-OS GlobalProtect and Prisma Access. Once inside, they use the organization's own remote access service to steal credentials, move laterally, and stage ransomware, with Cobalt Strike, BloodHound, and SharpHound among the tooling ReliaQuest observed. Because the traffic arrives through a legitimate VPN, it resembles normal remote work, which is precisely what delays detection. ReliaQuest assesses that exploitation is highly likely to continue for the next three months as ransomware groups and initial access brokers work through unpatched systems.

The flaw is not new. Palo Alto Networks' advisory was published on May 13, rates the issue 7.8 with its highest suggested urgency, and now lists exploit maturity as "attacked." The root cause is reliance on authentication override cookies without proper validation and integrity checks. Exposure requires those cookies to be enabled on a GlobalProtect portal or gateway along with a specific certificate configuration, which means many organizations can close the hole with a configuration change even before they schedule an upgrade: disable the cookie options, or issue a dedicated certificate used only for those cookies. Cloud NGFW and Panorama are not affected. Five months after disclosure, the fact that ransomware crews are still finding vulnerable gateways says more about patch practice at the edge than about the bug itself.

The Patch Closes the Door, Not the Session

The most consequential advice in ReliaQuest's guidance is easy to miss. Upgrading a gateway stops new forged sessions, but it may not remove access an attacker gained earlier. ReliaQuest recommends terminating all active GlobalProtect sessions after patching so every user must re-authenticate, and Palo Alto's own advisory notes that users will need to sign in again once after the upgrade. ReliaQuest also urges teams to investigate what happened after any suspicious VPN connection rather than trusting the connection itself, and offers a small but practical lead: a connecting device hostname containing "kali" is worth a closer look, though it is not proof of compromise. For hybrid Prisma Access deployments, the on-premises firewalls need upgrading too; an incomplete rollout can cause cookie compatibility problems.

SonicWall's appliances show how short the gap between fix and attack has become. BleepingComputer reported on October 9 that CVE-2026-102255, a maximum-severity flaw in the Appliance WorkPlace interface of SMA1000 6210, 7210, and 8200v models, was patched on Tuesday, October 6. Three days later Previdian's honeypot network detected exploitation attempts consistent with the flaw, and threat intelligence firm Defused said it was observing unauthenticated request forgery traffic against its SonicWall decoys. Previdian founder Ryan Dewhurst said it remains unknown whether those attempts would have compromised real systems. Shadowserver tracks more than 400 SMA1000 appliances exposed online. This is the third SMA1000 episode in four months: two zero-days were exploited for weeks in July, and SonicWall warned in September that attackers were chaining two more. Over the past four years CISA has added 19 SonicWall vulnerabilities to its Known Exploited Vulnerabilities catalog and flagged 13 of them as used by ransomware gangs.

The Quarter's Numbers Say This Is the Pattern

These are not isolated incidents. Daily CyberSecurity's Q3 2026 CVE report counted 100 new entries in CISA's Known Exploited Vulnerabilities catalog between July and September, up 33.3% from 75 in the second quarter, with additions rising every month: 26 in July, 31 in August, and 43 in September. Cisco accounted for seven of the exploited flaws, and Fortinet and SonicWall for four each, with MikroTik contributing three; the report singles out firewalls, VPN gateways, and routers as easy first targets because they sit directly on the internet. Speed is the other half of the story. Of the 58 catalog entries with a parseable publish date, 15, or 26%, were exploited within seven days of publication, and 49 of the 100 carried a severity score of 9.0 or higher.

Put those figures next to the GlobalProtect and SonicWall cases and a clear operating rule emerges. A remote access gateway should be treated as an identity system that happens to run on network hardware: its configuration, its active sessions, and the behavior of everyone who passes through it all need the same scrutiny as a domain controller. Patching remains necessary, but on its own it is a lagging control for a device attackers reach within days.

• Check configuration exposure today, not at the next window. CVE-2026-0257 needs authentication override cookies enabled; disabling them or issuing a dedicated cookie certificate removes the exposure without waiting for an upgrade.
• Kill every session after patching a gateway. Force all GlobalProtect users to re-authenticate once the fix is in, because an upgrade alone may leave an attacker's existing session open.
• Hunt behind the VPN, not just at it. Review what each unusual session did next, look for Cobalt Strike, BloodHound, and SharpHound activity, and treat odd device names such as "kali" as leads.
• Pre-approve emergency patching for remote access appliances. With 26% of exploited flaws attacked within seven days and SonicWall hit three days after its fix, a monthly change board cannot keep pace.
• Finish hybrid rollouts completely. Prisma Access customers with on-premises firewalls must upgrade both sides, or cookie compatibility problems can push teams into risky rollbacks.
• Require a second signal after the tunnel. Device posture checks and step-up authentication for sensitive systems mean a forged VPN session alone is not enough to reach the data ransomware crews are after.

For years, the VPN has been where remote workers proved who they were. The GlobalProtect and SonicWall cases show attackers skipping that proof entirely and then blending into the crowd that passed it honestly. Organizations that only patch will close the door behind an intruder who is already inside. The ones that also clear sessions, watch post-login behavior, and stop treating a tunnel as a verdict on trust will be the ones that notice the difference in time.