PANW · News · 20261021N

GlobalProtect Vulnerability Exploitation

Palo Alto Networks Inc · 2026-10-21 · Importance 47 · Surprise 60

Ransomware groups Qilin and INC have reportedly exploited CVE-2026-0257 in Palo Alto Networks’ PAN-OS GlobalProtect VPN and Prisma Access platforms since June 2026. The authentication-bypass flaw can defeat multifactor authentication, enable unauthorized VPN access, and facilitate lateral movement, data theft, and ransomware deployment against enterprise, healthcare, and financial networks. Although Palo Alto Networks released a fix in May 2026, affected organizations are being urged to patch immediately, disable authentication-override cookies, terminate active GlobalProtect sessions, and monitor authentication logs, creating potential regulatory, remediation, and reputational exposure.

Key facts

• Ransomware groups Qilin and INC are actively exploiting CVE-2026-0257 in Palo Alto Networks' PAN-OS and Prisma Access platforms despite a vendor fix released in May 2026. source
• CVE-2026-0257 allows threat actors to bypass multi-factor authentication, establish illicit VPN connections, and target enterprise networks, virtualization platforms, and core backup systems for double extortion. source
• Several ransomware groups, including Qilin and Inc, have been exploiting CVE-2026-0257 in Palo Alto Networks' PAN-OS GlobalProtect VPN since June. source
• CVE-2026-0257 enables attackers to bypass multi-factor authentication and establish unauthorized VPN connections to then use legitimate IT tools for lateral movement, data theft, and ransomware deployment. source
• Ransomware groups Qilin and INC exploited a critical authentication bypass in Palo Alto Networks GlobalProtect VPN for approximately four months despite a patch released in May. source
• Palo Alto Networks firewalls are reported to be under severe cybersecurity threat due to vulnerabilities in their PAN-OS operating system that allow threat actors to bypass authentication and gain unauthorized VPN access. source
• Ransomware groups Qilin and INC have been linked to exploiting PAN-OS weaknesses for data theft and extortion. source