Ransomware Gangs Exploit Palo Alto GlobalProtect VPN Flaw Patched in May

Ransomware operators are exploiting a Palo Alto GlobalProtect vulnerability that the company patched on May 13, 2026, and many internet-facing systems still have not been updated. Unit 42, the threat research team at Palo Alto Networks, publicly named two of the groups on October 19, according to a tech-insider write-up. The warning is new and specific, but the attacks began months earlier. This is an ongoing campaign, not a single breaking incident.

What the GlobalProtect bypass lets attackers do

The flaw is tracked as CVE-2026-0257. It lets an attacker without valid credentials bypass restrictions and open an unauthorized VPN connection, according to Cybersecurity News. The bug is an authentication bypass in the GlobalProtect portal and gateway of PAN-OS, and it also affects certain Prisma Access configurations, per Safeguard.sh.

Exploitation depends on two conditions. Authentication override cookies must be enabled, and the system must use a specific certificate configuration, according to Arctic Wolf. Administrators who disabled override cookies, or who do not use that certificate setup, fall outside the reported attack path. That narrows the exposure, but it does not clear anyone who has not checked.

The severity score also matters for prioritization. Safeguard.sh reports a CVSS 7.8 (High) rating under CVSS v4.0, up from an initial medium score of 4.7. Palo Alto's advisory was last updated on June 3, 2026.

A timeline from the May patch to the October warnings

The timeline shows how long a known fix sat unapplied on internet-facing devices. Dates come from the sources cited in this story, and the exploitation start date is disputed, as noted below.

The 149 days between the patch and ReliaQuest's October 9 finding is the core problem. Edge devices are often hard to patch on a fixed schedule, and a VPN appliance that stays up for months becomes a long-lived target.

Which ransomware groups are exploiting the flaw

Qilin is the best-documented actor. Unit 42 tracks it as Spikey Scorpius and named INC, tracked as Tarnished Scorpius, alongside it. ReliaQuest reported that Qilin and Settra were still exploiting unpatched systems and identified three attacker IP addresses tied to Qilin infrastructure, according to Decryption Digest.

Settra is less certain. Palo Alto has not confirmed the Settra attribution, so readers should treat it as a reported name rather than a verified separate group.

The start date is also disputed. Rapid7 observed exploitation on May 17, while Help Net Security reported that several ransomware groups have been exploiting the flaw since June across healthcare, education, government and energy, according to Help Net Security. Either way, exploitation started well before the October warnings.

Ransomware operators often reuse known, already-patched bugs when organizations delay updates on edge devices, and this case fits that pattern. A VPN bypass gives attackers a trusted remote-access path that can look like a legitimate worker. Cyware's October 24 threat briefing said Unit 42 linked the exploitation to ransomware operators and described it as a route to VPN access, MFA bypass and lateral movement, as Cyware reported.

How to check your Palo Alto GlobalProtect vulnerability exposure

IT and security teams should work through these steps in order, starting with confirmation of exposure rather than an assumption that a patch is in place.

1. Inventory every GlobalProtect portal and gateway, including any tied to Prisma Access. Record the PAN-OS build on each one and compare it with the affected versions listed in Palo Alto's advisory.
2. Check whether authentication override cookies are enabled, and whether the certificate configuration matches the conditions described above.
3. Upgrade affected systems to a fixed build. If an upgrade cannot happen right away, disable authentication override, or use a dedicated certificate for override cookies only. Those are Palo Alto's listed workarounds.
4. Remove firewall management interfaces from the public internet, as Unit 42 advised on October 20.
5. End existing VPN sessions after patching so that any session an attacker established earlier cannot continue.
6. Hunt for prior intrusion. Review VPN authentication logs for unexpected sessions, unfamiliar source addresses and new accounts, and look for signs of lateral movement.
7. Rotate credentials for accounts that connected through the portal, since a prior session may have exposed them.

Consumers are not directly targeted. Employees whose work depends on these VPNs should expect their companies to force password resets and re-authentication, and that disruption is the most likely way most people will feel this campaign.

Why 167,000 exposed portals keep the risk alive

A ReliaQuest figure cited by Decryption Digest says more than 167,000 GlobalProtect portals were publicly reachable about five months after the patch. That number comes from a secondary blog and has not been checked against primary data, so treat it as a directional estimate rather than an audit.

Public reachability matters because an attacker only needs to find one exposed, unpatched portal. Removing management interfaces from the internet, as Unit 42 advised, reduces the number of places an attacker can probe. The advice also points to a wider problem: exposed administrative functions on edge devices are a recurring entry point.

Palo Alto's PAN-OS line has had other exploited flaws this year. CISA added CVE-2026-0322, a PAN-OS management interface code injection flaw, to its KEV catalog on October 14, according to CISA. Edge-device attacks are not confined to one vendor, either. USA 24 has covered a BeyondTrust zero-day that China-linked hackers exploited for seven weeks and a suspected North Korean group scanning 216 PHP servers for PHP2Shell flaws.

What to watch next

Several questions remain open. The most important is how many US organizations have been breached through this flaw. The sources reviewed for this story named no US victims, so the scale of the damage is still unknown.

Watch whether Palo Alto confirms or rejects the Settra attribution, and whether CISA publishes its own alert for CVE-2026-0257. No CISA-published advisory for this CVE turned up in this reporting. Watch also whether the 167,000-portal figure holds up against primary data, and whether more ransomware groups add the flaw to their playbooks as unpatched portals remain online.