PANW · News · 20261020N

PAN-OS Vulnerability Regulatory Risk

Palo Alto Networks Inc · 2026-10-20 · Importance 44 · Surprise 60

Ransomware groups Qilin and INC are actively exploiting CVE-2026-0257, a high-severity authentication-bypass vulnerability in Palo Alto Networks’ GlobalProtect portal and PAN-OS. The flaw enables unauthorized VPN access despite multi-factor authentication, followed by reconnaissance, lateral movement, credential harvesting, data exfiltration, and ransomware deployment. Reporting states that exploitation began in early June and that attackers have pivoted to virtualization layers to disable security controls. Palo Alto Networks’ Unit 42 urged customers to apply patches, search for indicators of compromise, and investigate affected networks.

Key facts

• Palo Alto Networks' Unit 42 has been investigating compromises related to the PAN-OS CVE-2026-0257 and has urged immediate patching and network investigation. source
• Multiple ransomware groups have been exploiting a high-severity authentication bypass bug CVE-2026-0257 in Palo Alto Networks' PAN-OS since early June. source