Ransomware Gangs Target Palo Alto GlobalProtect VPN Flaw That Lets Attackers Skip Login

Palo Alto Networks' Unit 42 team has observed active exploitation of CVE-2026-0257, a vulnerability in PAN-OS, the software that runs Palo Alto firewalls. The flaw is an authentication bypass in the GlobalProtect portal and gateway components. In vulnerable versions, it could let an unauthorised attacker get around security controls and start a virtual private network (VPN) connection. The flaw was added to the Known Exploited Vulnerability (KEV) catalog on 13 May 2026.

In an update dated 19 October, Unit 42 said it continues to see attempted exploitation by ransomware operators, including Spikey Scorpius (also known as Qilin) and Tarnished Scorpius (also known as Inc). It is also aware of public reporting that links exploitation to actors using Settra ransomware. Earlier observations involved an unidentified threat actor. Only a small portion of the probed devices actually established VPN sessions, and Unit 42 had not identified any post-access behaviour or lateral movement as of its report.

Unit 42 advises organisations to hunt for the indicators listed in its report, and to activate incident response for any successful gateway-connected events linked to them. It also recommends reviewing the security advisory for CVE-2026-0257, applying the available workarounds and mitigations, or upgrading to a version that includes a fix. Note that this summary is based on the opening of the report, so check the full advisory for affected versions and indicator details.