Ransomware Gangs Exploit Palo Alto Firewall Flaw to Slip Past MFA and Reach Corporate Networks

Ransomware groups including Qilin and Inc have been exploiting a high-severity authentication bypass flaw in Palo Alto Networks' PAN-OS, according to Unit 42, the vendor's incident response arm. The bug, tracked as CVE-2026-0257, affects PAN-OS GlobalProtect portals and gateways. It can let attackers bypass security restrictions and set up an unauthorised VPN connection. Unit 42 says it has been investigating attacks since early June across industries such as finance, healthcare and manufacturing, as well as education, government, hospitality, legal services, utilities and retail.

Palo Alto Networks disclosed and patched the flaw on May 13, initially rating it medium severity and saying it had not seen malicious exploitation. That view changed quickly. By the end of May, Rapid7 researchers reported successful exploitation across multiple customer environments dating back to at least May 17. ReliaQuest analysts have also warned that multiple threat groups, including Settra ransomware operators, are using the bug to gain initial access through unauthorised VPN sessions.

Unit 42's Andy Piazza said attackers use the flaw to gain a foothold, then bypass multi-factor authentication to establish a VPN session. From there, they move across the network using Remote Desktop Protocol and Server Message Block, drop extra malware to harvest credentials and steal data, and finally deploy ransomware. Palo Alto Networks did not tell The Register how many organisations have been affected.