# Ransomware Gangs Exploit Palo Alto GlobalProtect Flaw CVE-2026-0257

- URL: https://usa-24.com/palo-alto-globalprotect-ransomware-flaw/
- Publisher: USA 24
- Section: Cybersecurity
- Published: 2026-11-01T05:37:05.880Z
- Updated: 2026-11-01T05:37:05.886Z
- Topics: Ransomware, Palo Alto Networks, VPN Security, Patch Management, Multi-Factor Authentication

> Qilin and INC ransomware operators are exploiting a Palo Alto Networks GlobalProtect flaw, CVE-2026-0257, to bypass multi-factor authentication and reach corporate networks.

## Key takeaways

- Unit 42 says ransomware operators Qilin (Spikey Scorpius) and INC (Tarnished Scorpius) are exploiting CVE-2026-0257 in Palo Alto Networks GlobalProtect.
- ReliaQuest said it detected Qilin and Settra ransomware groups exploiting the same flaw in financially motivated attacks, days before the Unit 42 update.
- The reported attacks use the flaw to bypass multi-factor authentication, which raises the risk beyond a typical unpatched-VPN story.
- The sources reviewed do not confirm affected GlobalProtect versions, the fixed releases, or whether CISA has added the CVE to its KEV catalog.
- IT teams should apply Palo Alto's fix once confirmed, review GlobalProtect and authentication logs, and reset credentials for portal users.

Two ransomware operators are now using a flaw in Palo Alto Networks' GlobalProtect remote-access portal to get past multi-factor authentication and into corporate networks. The groups are Qilin and INC, and the flaw is tracked as CVE-2026-0257. The details come from Unit 42, the threat intelligence team at Palo Alto Networks, as reported in [The Hacker News's ransomware coverage](https://thehackernews.com/search/label/ransomware).

## Palo Alto GlobalProtect ransomware attacks: what is confirmed

Unit 42 named the operators in an update. In its words, "Ransomware operators exploiting CVE-2026-0257 include Spikey Scorpius (aka Qilin) and Tarnished Scorpius (aka INC)." Those aliases are worth adding to threat intelligence searches, since vendors and researchers often use different names for the same group.

A separate report from ReliaQuest said days earlier that it had detected both Qilin and Settra ransomware groups actively exploiting the same flaw in financially motivated attacks. That points to more than one crew using the flaw. [Cybersecurity Dive](https://www.cybersecuritydive.com/) also reports that multiple threat actors have exploited a high-severity flaw in Palo Alto's GlobalProtect portal, and it lists the activity as a ransomware targeting expansion.

The timing is still fuzzy. The sources reviewed do not confirm the exact publication date of the Unit 42 update or the ReliaQuest report. The Hacker News covered the Unit 42 update on a Monday, but the sources did not show the date, so treat the sequence of events as reported rather than timestamped.

## Why an MFA bypass changes the risk

Most VPN stories involve a missing patch and a patient attacker. This one is more serious because the attacks are reported to use the flaw to bypass multi-factor authentication. MFA on a remote-access portal is often the control that keeps a stolen password from becoming a network break-in. When that control can be sidestepped at the gateway, resetting one password is not enough to close the door.

The exposure is broad. Palo Alto gear is common in US enterprise and government networks, so any organization running GlobalProtect or a similar portal has a reason to check its exposure. Employees whose credentials pass through the portal are also at risk, because stolen logins can be reused on other systems.

The sources do not explain how the bypass works, how many organizations have been affected, or whether any victims have been named. That gap matters. Without the technical method, defenders cannot yet write precise detection rules, which is why log review and credential resets should happen now rather than after more details arrive.

Consumers feel this indirectly. Ransomware at an employer, a hospital or a school district usually shows up as stolen records, extortion demands or days of disrupted service. The [Oneonta school district case](https://usa-24.com/oneonta-city-school-district-ransomware/) shows how a single ransomware attack can shut down a public school system.

## Edge devices keep being the way in

Remote-access gateways sit at the edge of the network, facing the internet and authenticating outsiders. That position makes them valuable to attackers and easy to scan. Cybersecurity Dive has reported that ransomware gangs were targeting Palo Alto, Fortinet, Citrix and Check Point VPNs to reach corporate networks, and the same pattern appears across vendors. Edge gear is also being abused for more than access, as in the [Cisco SD-WAN flaw used to steal encryption keys](https://usa-24.com/cisco-sd-wan-vulnerability-keydrift/).

Other recent warnings point the same way. The FBI and Secret Service warned in October that the FortiBleed campaign was locking administrators out of FortiGate firewalls and feeding ransomware affiliates such as INC, Lynx and Payload, according to [Cybersecurity Dive](https://www.cybersecuritydive.com/news/fbi-fortibleed-credential-harvesting-attacks/832366/) and [Infosecurity Magazine](https://www.infosecurity-magazine.com/news/fbi-secret-service-fortibleed/). INC appears in both stories. The sources do not show that the GlobalProtect exploitation and FortiBleed are the same operation, so keep those threads separate until someone confirms a link.

Palo Alto also has a separate problem on the government side. CISA added CVE-2026-0322, a PAN-OS code injection flaw, to its Known Exploited Vulnerabilities catalog on October 14, 2026, according to a [CISA bulletin](https://content.govdelivery.com/accounts/USDHSCISA/bulletins/42f2e7f). That is a different CVE from the GlobalProtect flaw. Still, two Palo Alto problems in a short window mean network teams should review every internet-facing Palo Alto device, not only GlobalProtect.

Ransomware has grown well beyond individual gangs. CISA says SafePay ransomware has breached more than 600 critical infrastructure organizations worldwide since 2024, a figure reported by [BleepingComputer](https://www.bleepingcomputer.com/tag/ransomware/). It is the largest victim count in the sources reviewed for this story.

## Which GlobalProtect versions need attention

This is where the sources fall short. The reviewed material does not list the affected GlobalProtect versions or the fixed releases for CVE-2026-0257. Do not work from this article for version numbers. Open Palo Alto Networks' security advisory for the CVE and match the affected builds against each product line and release you run.

The sources also do not confirm whether CISA has added CVE-2026-0257 to its KEV catalog. If CISA lists it, federal patch deadlines under BOD 26-04 would apply, and those can be very short. A recent KEV entry for a GitLab flaw gave agencies three days, according to [Cyber Security News](https://cybersecuritynews.com/gitlab-integer-overflow-vulnerability-exploited). Private companies are not bound by those deadlines, but they show how quickly defenders may need to move.

## Steps IT and security teams should take now

These are general steps, not instructions from a specific vendor advisory. Confirm the details in Palo Alto's advisory before changing production systems.

- Apply Palo Alto Networks' security update for CVE-2026-0257 to every GlobalProtect instance once you have confirmed the fixed version for that build.
- Pull GlobalProtect and authentication logs back to at least the start of the reported exploitation, and look for logins from unfamiliar sources, unexpected MFA approvals and repeated authentication attempts from a single address.
- Reset passwords and end active sessions for every account that used the portal, starting with administrators, contractors and service accounts.
- Check whether any remote-access portal is reachable from the internet when it does not need to be, and restrict it by IP range or move it behind a stronger access layer.
- Confirm that offline backups exist for systems behind the gateway, and test a restore before you need one.

Tell staff to report MFA prompts they did not start, even if they approved nothing. Those prompts are worth investigating immediately.

## What to watch next

Three signals will show how far this goes. First, whether Palo Alto publishes affected and fixed versions in its advisory, and whether Unit 42 releases indicators of compromise that defenders can search for. Second, whether CISA adds CVE-2026-0257 to KEV, which would start the federal clock. Third, whether Qilin or INC name victims on their leak sites, which would reveal how many organizations were reached.

Each answer will change how urgent the patch timeline feels. Until then, the safe assumption is that GlobalProtect portals are a live target, and that MFA alone may not be enough.

## Frequently asked questions

### What is CVE-2026-0257?

CVE-2026-0257 is a flaw in Palo Alto Networks' GlobalProtect remote-access portal. Unit 42 says ransomware operators Qilin and INC are exploiting it. The sources reviewed do not confirm the affected versions, so check Palo Alto's security advisory directly before making changes.

### Which ransomware groups are using the Palo Alto GlobalProtect flaw?

Unit 42 named Qilin, also called Spikey Scorpius, and INC, also called Tarnished Scorpius. ReliaQuest said it detected Qilin and Settra exploiting the same flaw in financially motivated attacks. Those reports came days apart, and their exact dates were not confirmed in the sources reviewed.

### Does the flaw let attackers bypass MFA?

Reports say the attacks use the flaw to bypass multi-factor authentication. The sources do not explain the technical method. Organizations should review authentication logs for unexpected logins and MFA approvals rather than assume their MFA is working as intended.

### What should a company running GlobalProtect do now?

Apply Palo Alto's security update once you confirm the fixed version for your build. Review GlobalProtect and authentication logs, reset credentials for portal users, and restrict any portal that does not need to be reachable from the internet.

## Sources

1. [Latest ransomware news (The Hacker News, ransomware topic page)](https://thehackernews.com/search/label/ransomware)
2. [Cybersecurity News and Analysis (Cybersecurity Dive)](https://www.cybersecuritydive.com/)
3. [Latest Ransomware news (BleepingComputer, ransomware tag)](https://www.bleepingcomputer.com/tag/ransomware/)
4. [CISA Adds Four Known Exploited Vulnerabilities to Catalog (CISA bulletin, Oct. 14, 2026)](https://content.govdelivery.com/accounts/USDHSCISA/bulletins/42f2e7f)
5. [FBI warns that FortiBleed credential-harvesting attacks are locking out firewall users (Cybersecurity Dive)](https://www.cybersecuritydive.com/news/fbi-fortibleed-credential-harvesting-attacks/832366/)
6. [FBI and Secret Service Warn of FortiBleed Lockout Threat (Infosecurity Magazine)](https://www.infosecurity-magazine.com/news/fbi-secret-service-fortibleed/)
7. [CISA Warns of GitLab Integer Overflow Vulnerability Exploited in Attacks (Cyber Security News)](https://cybersecuritynews.com/gitlab-integer-overflow-vulnerability-exploited)