Palo Alto Networks' PAN-OS has been under sustained attack since June, with multiple ransomware groups exploiting a high-severity authentication bypass tracked as CVE-2026-0257. The bug affects GlobalProtect portals and gateways, allowing attackers to bypass security restrictions and establish unauthorized VPN connections. The vendor patched it on May 13 with an initial medium-severity rating, but Rapid7 researchers soon observed successful exploitation in customer environments dating back to at least May 17.
Unit 42, Palo Alto Networks' incident response arm, says ransomware crews including Qilin and Inc are using the flaw to gain an initial foothold, bypass multi-factor authentication, and create VPN sessions. From there, they move laterally over RDP and SMB, drop credential-harvesting malware, and eventually deploy ransomware. The attacks have hit education, financial services, healthcare, manufacturing, government, and other sectors. ReliaQuest analysts also warn that Settra ransomware operators are exploiting the same bug.
One notable development is a pivot to the virtualization layer. In a case described by Unit 42, attackers moved from a compromised VPN gateway to a vCenter management appliance, disabled security controls on ESXi hypervisors, and used a custom tool to dump credentials offline from a domain controller's virtual disk, bypassing in-guest endpoint detection. The criminals have also chained this exploit with CVE-2023-27532, which targets Veeam backup infrastructure.
Organizations running vulnerable PAN-OS software should patch immediately and hunt for signs of compromise using Unit 42's indicators of compromise. Palo Alto Networks did not respond to questions about how many organizations have been affected.