When Your Employer’s VPN Gets Hacked: Why a Personal Home IP Setup Is Your Firewall

Hackers are not breaking into corporate networks through the front door anymore. They are walking in through the VPN itself.

Security researchers at ReliaQuest confirmed on October 11 that ransomware groups are actively exploiting a flaw in Palo Alto Networks’ GlobalProtect VPN. The vulnerability, tracked as CVE-2026-0257, lets an attacker forge an authentication cookie and establish a fully authorized VPN session without any valid credentials. From the network’s point of view, the intruder looks like just another employee working from home.

The groups doing this are not amateurs. Qilin, a ransomware-as-a-service operation, and a newer variant called Settra have both been observed using the flaw to gain initial access, then moving laterally through internal networks before deploying ransomware. Palo Alto disclosed the vulnerability back on May 13 and rated it high severity, but five months later, unpatched systems are still being hunted.

Here is the part that should worry every remote worker: patching alone does not remove the threat. ReliaQuest warns that administrators must also terminate all active VPN sessions after patching, because an attacker who already established a session keeps their access. The compromised session resembles legitimate employee access, which makes detection genuinely hard.

Your work VPN is not your privacy VPN

Most remote workers conflate two very different things: the VPN their employer requires, and the VPN (or setup) that protects their personal digital life. They serve opposite purposes.

Your employer’s VPN exists to give the company visibility and control. It routes your traffic through corporate infrastructure, often with monitoring, logging, and security policies you did not choose. When that infrastructure has a vulnerability like CVE-2026-0257, every person connected through it is exposed through no fault of their own.

Your personal setup exists to protect you. Banking logins, personal email, streaming accounts, and the dozens of other services tied to your identity deserve to travel through infrastructure you control, not infrastructure where a forged cookie can turn an attacker into a phantom coworker.

The separation principle

Security professionals have a simple rule: separate your concerns. Work traffic goes through work infrastructure. Personal traffic goes through personal infrastructure. Never mix them.

In practice, this means keeping personal accounts off the corporate VPN. When you need to check your bank balance or log into personal email, disconnect from the work VPN first. Better yet, use a separate device or a separate network path for personal activity. And run your own trusted path for personal traffic, where your bank sees your home IP and no corporate vulnerability can compromise it.

What to do this week

If your employer uses Palo Alto GlobalProtect, ask your IT team two questions: have all gateways been updated past the May fix, and were all active sessions terminated after patching? Regardless of what your employer runs, audit which personal accounts you access while connected to the work VPN. Each one is a reason to establish a personal path that does not depend on infrastructure you do not control.

Frequently asked questions