PANW · News · 20261021N

Security Product Vulnerabilities

Palo Alto Networks Inc · 2026-10-21 · Importance 47 · Surprise 60 · In source text

Ransomware groups Qilin and INC have exploited CVE-2026-0257 in Palo Alto Networks’ PAN-OS GlobalProtect VPN and Prisma Access platforms since June, despite a vendor fix released in May. The authentication-bypass flaw can circumvent multifactor authentication, establish unauthorized VPN connections, and enable lateral movement, data theft, and ransomware deployment. Reported targets include enterprise networks, virtualization platforms, backup systems, and organizations in healthcare and finance. Palo Alto Networks recommends patching, disabling authentication-override cookies, terminating active GlobalProtect sessions, reviewing configurations, and monitoring authentication logs.

Key facts

• Unit 42 identified two critical remote code execution vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 (CVSS 4.0), and Palo Alto Networks recommends immediate patching. source
• Unit 42 states over 22.6 million exposed instances are potentially at risk from the PHP vulnerabilities and Palo Alto Networks offers product protections through Cortex XDR, XSIAM, Cortex Cloud, Prisma Cloud, Cortex Xpanse, and Next-Generation Firewall. source

Impact estimates