# PAN-OS firewall flaw exploited by multiple ransomware groups

> Ransomware groups including Qilin and Inc have exploited CVE-2026-0257, a Palo Alto Networks firewall authentication bypass. Unit 42 has been investigating attacks since early June across finance, healthcare and manufacturing.

- Published: 2026-10-21
- Topic: [Security](https://futuretechnologyhq.com/topic/security/)
- URL: https://futuretechnologyhq.com/article/palo-alto-firewall-flaw-exploited-by-multiple-ransomware/
- Publisher: [Future Technology](https://futuretechnologyhq.com/), free to read. Quote as "Future Technology" with a link to the article.

## Key points

- Ransomware groups Qilin and Inc have actively exploited CVE-2026-0257, with successful exploitation observed from at least May 17, four days after Palo Alto's May 13 patch
- Attackers use the vulnerability to bypass multi-factor authentication and establish unauthorised VPN sessions; the most significant tactical evolution involves pivoting to virtualisation infrastructure
- Unit 42 has observed infections across numerous industry sectors; organisations using unpatched PAN-OS GlobalProtect portals and gateways face immediate risk

## Article

Palo Alto Networks disclosed and patched CVE-2026-0257 on 13 May, initially assigning it a medium-severity rating. The authentication bypass affecting PAN-OS GlobalProtect portals and gateways allows unauthenticated remote attackers to establish VPN sessions without valid credentials when authentication override cookies are enabled with specific certificate configurations. Successful exploitation was observed from at least 17 May, four days after the patch became available. Unit 42, Palo Alto's consulting and incident response business, has been investigating active exploitation since early June across numerous industries including education, financial services, healthcare, high tech, hospitality, manufacturing, professional and legal services, government, transportation and logistics, utilities and energy, and wholesale and retail.

Rapid7 researchers observed successful exploitation across multiple customer environments dating back to at least 17 May. The timeline reveals a critical gap between patch availability and protection in the field, with attackers moving quickly to weaponise the vulnerability despite its initial medium-severity classification.

Ransomware operators exploit the authentication bypass to gain initial access and establish VPN sessions, then subsequently bypass multi-factor authentication controls. This combination grants them network access as though they possessed legitimate credentials. Once inside the network perimeter, attackers move laterally using Remote Desktop Protocol and Server Message Block (SMB), installing credential-harvesting malware and exfiltrating data before ultimately deploying ransomware.

The most significant tactical evolution concerns virtualisation infrastructure. Unit 42 documented a case in which attackers progressed from the compromised VPN gateway directly to vCenter, the management appliance controlling virtual machines. From there they disabled security controls on ESXi hypervisors (execInstalledOnly), then used custom tooling to perform offline credential dumping against a domain controller's virtual disk (VMDK).

This approach represents a sophisticated circumvention of endpoint detection and response products. By stealing domain-wide credentials from offline copies, attackers obtain keys to the entire network without triggering in-guest defences.

ReliaQuest threat intelligence analysts warned that multiple threat groups, including Settra ransomware operators, are also exploiting the bug to gain initial access to corporate networks via unauthorised VPN sessions. Some criminal groups have chained CVE-2026-0257 with other known flaws, particularly CVE-2023-27532 affecting Veeam backup infrastructure.

Arctic Wolf Labs investigated multiple intrusions in June 2026 that began with exploitation of CVE-2026-0257. Post-exploitation tradecraft varied across intrusions, from rapid encryption-only operations to full double-extortion, suggesting multiple affiliates operating under the Qilin ransomware-as-a-service umbrella. Attackers demonstrated consistent operational patterns despite tradecraft variation: staging ransomware at C:\PerfLogs\, using PsExec for lateral execution via administrative shares, deploying password-protected ransomware payloads, and implementing comprehensive log-clearing routines.

Follow-on attacks varied across victims, ranging from enterprise-wide encryption with no data exfiltration and extensive reconnaissance via remote access tools like AnyDesk, Ngrok, or LogMeIn to large-scale credential theft and instances of data exfiltration to the MEGA cloud service before ransomware deployment using Rclone, Proton Drive, and FileZilla. This variability is consistent with ransomware-as-a-service models, in which multiple affiliates may leverage shared initial access infrastructure and ransomware tooling whilst applying their own preferred post-exploitation methodologies.

Organisations operating PAN-OS GlobalProtect portals and gateways in unpatched states face immediate risk of network compromise. The vulnerability allows unauthenticated remote attackers to establish VPN sessions without valid credentials when authentication override cookies are enabled with specific certificate configurations, potentially bypassing multi-factor authentication controls.

Organisations should patch vulnerable systems immediately and investigate whether attackers have already gained access to their network, cross-referencing indicators of compromise against network activity. The virtualisation pivot tactic demands additional scrutiny. Organisations should audit hypervisor security settings, particularly execInstalledOnly configurations on ESXi hosts.

Data exfiltration prior to ransomware deployment means that infection detection itself does not guarantee containment of the breach. Organisations discovering successful exploitation should assume sensitive data may have been copied and prepare incident notifications accordingly. Unit 42 maintains indicators of compromise for threat-hunting activities, which organisations investigating potential breach should access to assist forensic investigation.

For IT teams across affected sectors, the essential action is immediate: identify all PAN-OS GlobalProtect deployments, confirm patch status, and begin forensic investigation of logs from 17 May onward.

## Sources

- [The Register](https://www.theregister.com/cyber-crime/2026/10/20/palo-altos-firewall-os-has-been-under-attack-from-multiple-ransomware-groups-since-june/5304226)
- [thehackernews.com](https://thehackernews.com/2026/07/qilin-ransomware-attackers-exploit-pan.html)