Ransomware Gangs Have Been Exploiting a Palo Alto GlobalProtect Flaw Since June

Several ransomware groups have been breaking into corporate networks through an authentication bypass in Palo Alto Networks' PAN-OS firewalls since at least June, according to the company's own incident response unit, Unit 42. The flaw, CVE-2026-0257, affects GlobalProtect portals and gateways, the VPN service many organisations use for remote access.

Palo Alto disclosed and patched the flaw on 13 May. Organisations that have not applied the fix are the ones being hit.

The flaw

PAN-OS trusts an authentication override cookie it can decrypt without properly checking that the firewall issued it. On a GlobalProtect portal or gateway configured to use authentication override cookies, with a vulnerable certificate configuration, that lets an attacker get past authentication. Palo Alto first rated the flaw medium severity and later raised it to high after confirming active exploitation. Beazley Security reports that it was added to CISA's Known Exploited Vulnerabilities catalogue on 29 May.

Fixed versions differ by PAN-OS branch. Organisations should check Palo Alto's advisory for CVE-2026-0257 against the exact release they run; on PAN-OS 12.1, for example, 12.1.4-h6 and 12.1.7 or later are fixed.

Who is using it

Rapid7 reported successful exploitation in several customer environments dating back to at least 17 May. Unit 42 has investigated attacks since early June and links them to the Qilin and Inc ransomware operations. ReliaQuest analysts say Settra ransomware operators are using the flaw as well. Unit 42 lists victims in education, financial services, healthcare, technology, hospitality, manufacturing, professional and legal services, government, transport and logistics, utilities and energy, and retail.

"Attackers are leveraging this vulnerability to gain an initial foothold into corporate networks," said Andy Piazza, senior director of threat intelligence at Unit 42, in comments to The Register.

What the attackers do next

According to Unit 42, the intrusions follow a familiar pattern: bypass multi-factor authentication to open a VPN session, move through the network over RDP and SMB, collect credentials, steal data, then deploy ransomware. In one case the attackers pivoted from the VPN gateway to a VMware vCenter appliance, disabled security controls on ESXi hosts and copied a domain controller's virtual disk to extract domain-wide credentials offline, a method Piazza described as "highly sophisticated". Unit 42 has also seen the flaw used together with CVE-2023-27532, an older vulnerability in Veeam backup software.

What to do

1. Patch PAN-OS to the fixed release for your branch.
2. Do not stop at patching. A firewall that was exposed while vulnerable may already have given attackers a way in. Review VPN logs for sessions you cannot account for, especially ones that skipped MFA.
3. Hunt for what comes after: unusual RDP and SMB activity from VPN address ranges, new accounts, access to vCenter and ESXi management, and changes to backup servers.
4. Patch Veeam if CVE-2023-27532 is still open on your backup infrastructure.
5. Use Unit 42's published indicators of compromise for threat hunting.

This is separate from CVE-2026-0322, a PAN-OS management interface flaw that CISA added to its catalogue on 14 October, and from the PHP2Shell flaws, which Palo Alto has confirmed affect PAN-OS and Panorama. Organisations running Palo Alto firewalls have three open issues to track this month.