Ransomware groups exploit Palo Alto GlobalProtect flaw CVE-2026-0257
Original title: Ransomware gangs have been exploiting Palo Alto GlobalProtect VPN flaw since June
Unit 42 has investigated intrusions since early June; Qilin, Inc, and Settra are among the operators named.
Several ransomware groups are using CVE-2026-0257, an authentication bypass in PAN-OS GlobalProtect patched in May, to open unauthorized VPN sessions on Palo Alto firewalls and Prisma Access. Palo Alto initially rated the flaw medium on May 13 and later reported limited exploit attempts; Rapid7 saw targeting of local administrator accounts from May 17. Unit 42 says attackers bypass MFA, move with legitimate IT tools, steal credentials, and deploy ransomware, including one path from the VPN gateway through vCenter to offline credential extraction. ReliaQuest also found Cobalt Strike, BloodHound, and SharpHound and advises patching plus session resets.
Unconfirmed: ReliaQuest assesses exploitation is highly likely to continue for three months; that forecast is not confirmed.
- The bug affects GlobalProtect portal and gateway on physical and virtual PAN-OS firewalls and Prisma Access.
- Cookies are accepted without detailed validation, allowing an unauthenticated VPN connection.
- Unit 42’s October 19 brief names Qilin and Inc; ReliaQuest also names Settra.
- One intrusion chained access with Veeam exploit tooling for CVE-2023-27532.
- ReliaQuest says patching may not remove VPN access established before remediation.
Impact: Unauthorized VPN access bypassing MFA, then ransomware and credential theft.
| Product | Affected |
|---|---|
| Palo Alto Networks PAN-OS GlobalProtect | — |
| Palo Alto Networks Prisma Access | — |
- 1.Upgrade affected PAN-OS and Prisma Access deployments without delay.
- 2.Disable authentication override cookies where they are not needed.
- 3.End active GlobalProtect sessions after patching and review unexpected connections, including hostnames such as kali.
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1133 External Remote ServicesT1003 OS Credential DumpingT1562.001 Disable or Modify ToolsT1486 Data Encrypted for Impact
- Vendors
- Palo Alto Networks
- Products
- PAN-OSGlobalProtectPrisma Access
- Organizations
- Unit 42Rapid7ReliaQuest
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2023-27532 | Missing Authentication in Veeam Backup & Replication Exposes Stored Credentials | 7.5 | 81% | KEVRansomware | KEV |
| CVE-2026-0257 | Authentication Bypass in Palo Alto Networks PAN-OS GlobalProtect Portal and Gateway | 7.8 | 97% | KEVRansomware | KEV |
From the original article
2 min read at helpnetsecurity.com
Several ransomware groups are exploiting CVE-2026-0257, an authentication bypass in Palo Alto Networks’ PAN-OS GlobalProtect patched in May, to break into organizations in sectors ranging from healthcare and education to government and energy.
By Sinisa Markovic · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.