PANW · News · 20261020N

GlobalProtect Vulnerability Exploitation

Palo Alto Networks Inc · 2026-10-20 · Importance 44 · Surprise 60

Ransomware groups Qilin and INC are actively exploiting Palo Alto Networks vulnerability CVE-2026-0257 in the GlobalProtect portal and PAN-OS. The authentication bypass enables unauthorized VPN connections and initial access to internal networks despite multi-factor authentication. Attackers have reportedly conducted reconnaissance, moved laterally, pivoted to virtualization layers, disabled security controls, harvested credentials, exfiltrated data, and deployed ransomware across multiple industries; Palo Alto Networks’ Unit 42 urged customers to patch and investigate networks.

Key facts

• Palo Alto Networks advises applying the latest fixes, hunting for indicators of compromise, and initiating incident response protocols regarding the CVE-2026-0257 exploit. source
• Ransomware groups Qilin (Spikey Scorpius) and INC (Tarnished Scorpius) are actively exploiting a patched Palo Alto Networks vulnerability CVE-2026-0257 to bypass multi-factor authentication and establish unauthorized VPN connections. source
• Attackers leverage CVE-2026-0257 to gain initial network access, conduct reconnaissance, move laterally, and deploy additional tools for credential harvesting, data exfiltration, and ransomware. source
• Ransomware groups including Qilin and INC are increasingly exploiting high-severity authentication bypass vulnerability CVE-2026-0257 in Palo Alto Networks' GlobalProtect portal enabling unauthorized VPN connections. source