Ransomware crews are walking through the front door of Palo Alto Networks VPN gateways, and that door has been open to attackers since late spring. Qilin and Inc operators are exploiting CVE-2026-0257, an authentication bypass in the GlobalProtect portal and gateway of PAN-OS, to open VPN sessions without valid credentials and skip multifactor authentication.
Unit 42, Palo Alto's threat intelligence team, updated its threat brief on October 19 and tied the flaw to named ransomware groups. The update documents intrusions that moved from the VPN into VMware infrastructure. Help Net Security and The Register picked up the story on October 20 and 21.
This is not a new zero-day. Palo Alto disclosed the bug and shipped a fix on May 13, 2026, and Rapid7 observed exploitation starting around May 17. It is also a separate bug from the PAN-OS zero-day CVE-2026-0322 that USA 24 has already covered.
Andy Piazza, senior director of threat intelligence at Unit 42, described the attackers' goal in a statement. Attackers use the flaw to “gain an initial foothold into corporate networks.” For defenders, the bigger story is the gap between the fix and the first attack.
Which Palo Alto products and builds are affected by CVE-2026-0257
Palo Alto's security advisory lists PAN-OS 12.1, 11.2, 11.1 and 10.2 as affected, along with Prisma Access. Panorama and Cloud NGFW are not affected. If you run GlobalProtect on any affected branch, treat the flaw as in scope until your exact build is confirmed.
The exposed surface is large. Shadowserver counts more than 167,000 GlobalProtect portals reachable from the internet, according to SC Media. Nobody outside the affected organizations knows how many of those portals are still unpatched. Help Net Security reports that Unit 42 has seen victims across finance, healthcare and manufacturing, and third-party reporting adds government and education. Unit 42 has not named any victims.
Severity has shifted twice. Palo Alto first rated the issue medium, with a CVSS v4 score of 4.7. Its May 29 update raised the CVSS v4 score to 7.8 after exploitation was confirmed. The National Vulnerability Database lists a CVSS v3.1 base score of 9.1, and some outlets quote that number without naming the version. Compare scores only within the same version.
A third-party advisory from Horizon3.ai lists example fixed builds, including:
- PAN-OS 11.2.4-h17
- PAN-OS 11.2.7-h14
- PAN-OS 11.2.10-h7
- PAN-OS 11.2.12
- PAN-OS 12.1.4-h6
- PAN-OS 12.1.7
- Prisma Access 10.2.10-h36 and 11.2.7-h13
Treat that list as a starting point, not a verdict. The example list includes no PAN-OS 11.1 or PAN-OS 10.2 builds, so look those up directly. Check your version against Palo Alto's live table. One third-party write-up flags inconsistent wording for PAN-OS 10.2, so do not assume that base release 10.2.18 closes the flaw.
How attackers get past MFA through GlobalProtect
GlobalProtect gives remote staff a way into internal systems, which makes the gateway a high-value target on the perimeter. This bypass lets an attacker establish an unauthorized VPN session without valid credentials. Because the session never needs a valid login, the MFA step that normally guards that login never gets a chance to stop it.
Unit 42 describes what follows as a familiar ransomware sequence: VPN entry, credential theft, lateral movement and then encryption. The playbook is not new. The entry point is what makes this campaign hard to defend, because a flaw in front of the authentication layer hands attackers a trusted session before the usual proof of identity takes place.
What ransomware crews do once they are inside
Unit 42 described internal reconnaissance through remote-management tools, lateral movement over RDP and SMB, credential harvesting and ransomware deployment. Cybersecurity Dive reports that ReliaQuest saw exploitation by Qilin and Settra operators, with Cobalt Strike, BloodHound and SharpHound in related activity. Settra's involvement rests on ReliaQuest and public reporting, not on Unit 42's own attribution.
Arctic Wolf observed June 2026 intrusions in which this flaw was the initial access vector and Qilin ransomware was deployed, according to SC Media. The most serious case comes from Unit 42's threat brief and Cyberpress. In at least one intrusion, attackers moved from the VPN gateway to the vCenter management appliance, disabled security controls on ESXi hosts and dumped credentials from a domain controller's virtual disk. Investigators also reported exploit tools aimed at Veeam backup infrastructure through CVE-2023-27532.
The VMware detail matters most. Whoever controls vCenter can change many hosts at once, so a single VPN foothold can become a fleet-wide problem. Backup infrastructure adds a second risk, because attackers who reach it can threaten the copies a victim would use to recover.
For context on how widely ransomware groups are hitting US organizations, see USA 24's coverage of SafePay ransomware, which the FBI and CISA have warned about.
Why a May patch still leaves networks exposed in October
The fix has been public for five months, and that is the core lesson. Palo Alto's May 29 advisory update said it had become aware of “limited exploit attempts on unpatched PAN-OS devices without mitigations applied,” a line that Help Net Security quoted. Codekeeper reported public proof-of-concept code appearing on May 29, but that is a secondary report, so treat the date with some caution.
On timing, Rogier Fischer, co-founder and CEO at Hadrian, said, as quoted by SC Media, “they needed to patch two months earlier.” The comment captures the problem. The window between patch release and attacker use is where the damage happens, and VPN gateways sit at the internet-facing edge, where any attacker can reach them.
The pattern is not limited to Palo Alto. USA 24 reported that Plex2Shell exploits hit unpatched Plex servers within a day, a reminder that attackers move quickly on newly public flaws.
How to check whether your PAN-OS firewall is patched
Start with your exact build, not a summary.
- Compare your running PAN-OS or Prisma Access build against Palo Alto's advisory for CVE-2026-0257, using the live affected-versions table.
- If you cannot patch right away, Palo Alto recommends disabling authentication override or using a dedicated certificate for it.
- After patching, expect GlobalProtect users to re-authenticate, and terminate active sessions as needed, according to Gridinsoft.
- Treat patching as the start of the response. Unit 42 advises that patching alone does not close an incident, so check whether earlier sessions reached internal systems.
What to hunt for in the next 30 days
Look back 14 to 30 days for suspicious VPN sessions. Then check the systems attackers reached in these cases: vCenter, ESXi hosts and domain controllers. Look for disabled security tooling on hypervisors, unusual credential access on domain controllers, and signs of Cobalt Strike, BloodHound or SharpHound activity.
Published client identifiers such as GP-CLIENT and WINDOWS-LAPTOP-001 are useful hunting leads, not standalone proof. If you suspect compromise, rotate privileged credentials before you close the investigation.
What comes next for GlobalProtect defenders
Expect more victim disclosures. Unit 42 has not named victims, and the sources reviewed do not confirm any ransom or data-leak figures. Watch whether Unit 42 confirms Settra's role, whether the Shadowserver count of exposed portals falls, and whether Palo Alto clarifies the PAN-OS 10.2 wording. The real test is how quickly organizations move from a public advisory to a verified build on every internet-facing gateway.
