Ransomware Gangs Still Exploiting Palo Alto VPN Flaw Months After a Fix Was Released

Ransomware groups are still targeting a Palo Alto Networks vulnerability, even though a security patch was released five months ago. In an advisory posted on October 9, security firm ReliaQuest said groups including Qilin and Settra are exploiting CVE-2026-0257 to set up unauthorised VPN sessions and gain initial access to internal networks.

The flaw is an authentication bypass in PAN-OS GlobalProtect and Prisma Access. Affected products include PAN-OS versions 10.2.0, 11.1.0, 11.2.0 and 12.1.0, and Prisma Access versions 10.2.0 and 11.2.0. Palo Alto Networks disclosed it on May 13, 2026, rating it 7.8 on the CVSS scale with a "highest" urgency rating. The US National Vulnerability Database rated it more severely, at a critical 9.1. The US cyber agency CISA added it to its Known Exploited Vulnerabilities list on May 29. Rapid7, Unit 42 and Arctic Wolf have all reported exploitation attempts in recent months.

ReliaQuest also observed the attackers deploying offensive security tools, including Cobalt Strike, BloodHound and SharpHound, alongside the exploitation. It assessed it "highly likely" that these groups will keep trying to exploit the flaw over the next three months. This summary is based on the opening of the source article, so further details may be available in the full report.