Palo Alto's firewall OS has been under attack from multiple ransomware groups since June

Multiple ransomware groups, including Qilin and Inc, have been exploiting a high-severity authentication bypass bug in Palo Alto Networks' PAN-OS, with Unit 42 investigating attacks since early June across numerous industries, such as finance, healthcare, and manufacturing.

CVE-2026-0257 affects PAN-OS GlobalProtect portals and gateways, potentially allowing attackers to bypass security restrictions and establish an unauthorized VPN connection.

The security vendor first disclosed and patched the bug on May 13 and initially assigned it a medium-severity rating, saying it was aware of attempts to exploit it but had not observed any malicious exploitation.

That assessment quickly changed, and by the end of the month, Rapid7 researchers said they observed successful exploitation across multiple customer environments dating back to at least May 17.

On Monday, Palo Alto Networks’ consulting and incident response biz, Unit 42, said ransomware crews including Qilin and Inc continue to batter the CVE.

“Attackers are leveraging this vulnerability to gain an initial foothold into corporate networks, subsequently bypassing multi-factor authentication (MFA) controls to establish a VPN session,” said Andy Piazza, a senior director of threat intelligence at Unit 42.

After gaining initial access, the criminals move laterally across the networks using Remote Desktop Protocol and Server Message Block (SMB), dropping additional malware for credential harvesting and data theft before ultimately deploying ransomware, Piazza warned.

In its ongoing investigations, Unit 42 has spotted the ransomware criminals infecting “numerous industries, including education, financial services, healthcare, high tech, hospitality, manufacturing, professional and legal services, government, transportation and logistics, utilities and energy, and wholesale and retail."

Palo Alto Networks did not respond to The Register’s inquiries about the attacks, including how many organizations have been infected.

Additionally, ReliaQuest intel analysts warned that “multiple threat groups,” including Settra ransomware operators, are also exploiting the bug to gain initial access to corporate networks via unauthorized VPN sessions.

“The most significant evolution in tactics, techniques and procedures (TTPs) following successful exploitation of CVE-2026-0257 is the direct pivot to the virtualization layer,” Piazza wrote. “In one notable case, attackers moved from the compromised VPN gateway to the vCenter management appliance. From there, they disabled security controls on ESXi hypervisors (execInstalledOnly) and used a custom tool to perform offline credential dumping directly against a domain controller's virtual disk (VMDK).”

This allows the miscreants to bypass in-guest endpoint detection and response products, and represents “a highly sophisticated method” of stealing domain-wide credentials, he added.

Unit 42 has also spotted criminals chaining this exploit for initial access with other vulnerabilities such as CVE-2023-27532, which targets Veeam backup infrastructure.

So if you haven’t already patched vulnerable PAN-OS software, do so now - and investigate whether attackers have already gained access to your network. Check Unit 42’s indicators of compromise to assist with threat-hunting activities.®