Ransomware groups exploit Palo Alto PAN-OS bug CVE-2026-0257
Original title: Palo Alto's firewall OS has been under attack from multiple ransomware groups since June
Unit 42 says Qilin, Inc and others use the GlobalProtect flaw for unauthorized VPN access, then ransomware, across many industries.
Unit 42 is investigating compromises that use CVE-2026-0257, an authentication bypass in PAN-OS GlobalProtect portals and gateways, since early June. Palo Alto disclosed and patched it on May 13, first rating it medium and saying it had not seen malicious exploitation. Rapid7 later reported successful exploitation from at least May 17. Attackers open VPN sessions while bypassing MFA, move with RDP and SMB, steal credentials and data, and deploy ransomware. Unit 42 also saw a pivot to vCenter and ESXi and chaining with CVE-2023-27532 against Veeam.
Unconfirmed: Palo Alto has not confirmed how many organizations were infected.
- Qilin, Inc and Settra are named among groups using the bug.
- Palo Alto did not say how many organizations were infected.
- One case dumped domain credentials offline from a domain controller VMDK.
- Industries named include finance, healthcare, manufacturing, government and energy.
- Unit 42 advises patching and hunting with its indicators of compromise.
Impact: Unauthorized VPN access, credential theft and ransomware
| Product | Affected |
|---|---|
| Palo Alto Networks PAN-OS GlobalProtect | — |
- 1.Patch vulnerable PAN-OS software if not already done.
- 2.Investigate whether attackers already reached the network.
- 3.Hunt using Unit 42 indicators of compromise.
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1133 External Remote ServicesT1021.001 Remote Desktop ProtocolT1021.002 SMB/Windows Admin SharesT1486 Data Encrypted for Impact
- Vendors
- Palo Alto Networks
- Products
- PAN-OSGlobalProtect
- Organizations
- Unit 42Rapid7ReliaQuest
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2023-27532 | Missing Authentication in Veeam Backup & Replication Exposes Stored Credentials | 7.5 | 81% | KEVRansomware | KEV |
| CVE-2026-0257 | Authentication Bypass in Palo Alto Networks PAN-OS GlobalProtect Portal and Gateway | 7.8 | 97% | KEVRansomware | KEV |
From the original article
2 min read at theregister.comUnit 42 investigates network compromises across numerous industries
By Jessica Lyons · theregister.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.