Ransomware Groups Abuse Palo Alto VPN Flaw to Bypass MFA
Unit 42 confirms multiple ransomware crews are exploiting a patched authentication bypass in PAN-OS to steal credentials.
Key points
- CVE-2026-0257 allows attackers to bypass security restrictions on GlobalProtect portals and gateways.
- Unit 42 investigations show ransomware groups Qilin and Inc exploiting the flaw since early June.
- The vulnerability enables unauthorized VPN sessions that circumvent multi-factor authentication controls.
Unit 42, Palo Alto Networks’ threat intelligence division, reports that ransomware operators including Qilin and Inc are actively exploiting a high-severity authentication bypass in PAN-OS. These attacks, observed since early June, allow criminals to establish unauthorized VPN connections and bypass multi-factor authentication protections across numerous industries.
The flaw, identified as CVE-2026-0257, affects GlobalProtect portals and gateways. According to Unit 42, attackers leverage this vulnerability to gain an initial foothold in corporate networks. Once inside, they move laterally using Remote Desktop Protocol and Server Message Block, deploying additional malware for credential harvesting before deploying ransomware payloads.
View the original post on X
Timeline and Severity Ratings
Palo Alto Networks disclosed and patched the bug on May 13, initially rating it as medium severity. The vendor stated at that time it was aware of exploitation attempts but had not observed malicious exploitation. That assessment changed by month’s end when Rapid7 researchers reported successful exploitation in multiple customer environments dating back to at least May 17.
The source material describes the bug as high-severity in the context of current ransomware exploitation. Unit 42’s latest update on Monday confirms that crews continue to target this CVE. Palo Alto Networks did not respond to The Register’s inquiries regarding the total number of infected organizations or further details on the ongoing campaign.
Impact Across Industries
Unit 42’s ongoing investigations reveal infections across a wide range of sectors. Affected industries include finance, healthcare, education, high tech, hospitality, manufacturing, government, transportation, utilities, energy, wholesale, retail, and professional services. This broad impact suggests the vulnerability remains a significant entry point for threat actors targeting enterprise infrastructure.
As Threat Times reported on 2026-10-20, ransomware actors exploited a GlobalProtect authentication bypass to access VMware infrastructure and harvest credentials. The current wave involving CVE-2026-0257 represents a continued focus on bypassing network perimeter defenses to harvest sensitive data and deploy malicious software.
What should you do?
Security teams should verify that all PAN-OS GlobalProtect portals and gateways have been updated to the patched version released on May 13. Administrators must monitor for unauthorized VPN sessions that bypass standard authentication flows, particularly those originating from unexpected sources. Reviewing logs for lateral movement via RDP and SMB can help detect post-exploitation activities before ransomware deployment.
Background: Threat intelligence program
A cyber intelligence program collects, analyzes, and distributes data about threats to help you defend your organization. It works by connecting external threat feeds to internal telemetry. You affect your security posture by prioritizing context over volume, ensuring every alert ties to a specific business risk or asset.
Read the full guide: Build a Cyber Intelligence Program That Cuts Noise and Finds Threats
What to do and how to stay safe: Palo Alto Networks
- Confirm that all PAN-OS devices running GlobalProtect are patched against CVE-2026-0257.
- Monitor network logs for unauthorized VPN connections that bypass multi-factor authentication.
- Check for lateral movement indicators such as unusual RDP or SMB traffic between internal systems.
- Isolate any systems showing signs of credential harvesting or unexpected malware execution.
Step-by-step guide: Social Engineering Warning Signs and How to Respond
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-0257?
It is a high-severity authentication bypass bug in Palo Alto Networks’ PAN-OS that affects GlobalProtect portals and gateways.
Who is exploiting this vulnerability?
Ransomware groups including Qilin and Inc are actively exploiting the flaw to gain initial access to networks.
Is there a patch available?
Yes, Palo Alto Networks disclosed and patched the bug on May 13, though exploitation continued afterward.
