Palo Alto PAN-OS GlobalProtect flaw exploited by ransomware (CVE-2026-0257)

Ransomware groups are exploiting CVE-2026-0257, an authentication bypass in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS, according to Help Net Security. CISA lists the flaw in its Known Exploited Vulnerabilities (KEV) catalog, flagged as used in ransomware campaigns, and the original KEV due date of 2026-06-01 has long passed. Any unpatched or unmitigated GlobalProtect gateway should be treated as a priority incident risk.

What happened

Palo Alto Networks disclosed the flaw on May 13 and first rated it medium severity. On May 29 it updated the advisory to say it had become aware of limited exploit attempts on unpatched devices without mitigations applied.

The reporting says the firewalls rely on cookies without detailed validation and integrity checking. That lets a remote, unauthenticated attacker bypass security restrictions and establish an unauthorized VPN connection. Rapid7 reported that attackers targeted the local administrator account on customer devices from May 17, with some reaching internal networks in a second wave on May 21.

On October 19, Unit 42 updated its threat brief and named the Qilin and Inc ransomware operators among those exploiting the flaw. Its responders have investigated related intrusions since early June. ReliaQuest also tracked several groups, including Qilin and Settra, and saw Cobalt Strike, BloodHound and SharpHound in the activity.

Am I affected?

The flaw affects the GlobalProtect portal and gateway on physical and virtual PAN-OS firewalls, and on Prisma Access. Panorama and Cloud NGFW are not impacted, per the NVD description. The NVD record lists affected PAN-OS builds including the following (the fixed versions are not stated in the data we reviewed, so check the vendor advisory):

• PAN-OS 10.2.7 through 10.2.18
• PAN-OS 11.1.0, 11.1.1 and 11.1.10

This looks like an excerpt of a longer list, so do not read it as complete. If you run GlobalProtect on any PAN-OS release, confirm your status against the vendor advisory.

Technical details

• Weakness: CWE-565, reliance on cookies without validation and integrity checking.
• Attack vector: network, no authentication required, no user interaction (from the CVSS v4.0 vector).
• Score: NVD shows CVSS 7.8 (High), noticeably below the practical urgency implied by ransomware use. The vendor first called it medium.
• EPSS: 0.96895, meaning a very high modelled likelihood of exploitation.
• KEV: added 2026-05-29, known ransomware campaign use: Known. Required action: apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

How the attacks work

Unit 42 says attackers use the flaw as an initial foothold and then bypass multi-factor authentication to establish a VPN session. Once inside they use legitimate IT management tools to explore the network, spread, and bring in tools to steal passwords and data before deploying ransomware.

In one case Unit 42 investigated, the attacker moved from the compromised VPN gateway to the vCenter management appliance, turned off security controls on ESXi hypervisors, and ran a custom tool against a domain controller’s virtual disk to extract credentials offline. That approach sidesteps in-guest EDR. Unit 42 also saw this access chained with exploit tools aimed at Veeam backup infrastructure (CVE-2023-27532).

Why this matters

Analysis, not new reporting. A VPN session that arrives through your own gateway looks like remote work, so alerts may stay quiet until credential theft or data staging begins. The sources cite healthcare, education, government and energy among targeted sectors. ReliaQuest assesses exploitation is highly likely to continue over the next three months, so patching late is still worth doing, but patching alone does not tell you whether someone already got in during the months since May.

How to detect and hunt for CVE-2026-0257 abuse

No indicators of compromise were published in the material we reviewed, so these ideas follow from the reported behaviour:

• Review GlobalProtect logs back to mid-May for VPN sessions that appeared without a matching MFA event, and for logins by the local administrator account.
• Look for new VPN sessions from unfamiliar addresses followed by remote administration tools, or by access to vCenter and ESXi hosts.
• Search for Cobalt Strike, BloodHound and SharpHound artifacts on hosts reachable from the VPN.
• Check for changes to hypervisor security settings and unusual access to domain controller virtual disks.
• Review Veeam servers for exploitation, since attackers were seen chaining it.

What to do

1. Treat this as in CISA KEV: patch or apply Palo Alto’s mitigations within hours, not the next maintenance window.
2. Follow the vendor advisory at security.paloaltonetworks.com for fixed releases and mitigations, covering PAN-OS and Prisma Access.
3. Hunt for compromise back to May 2026 using the ideas above, rather than assuming a patch closes the issue.
4. If you find a suspicious session, rotate local administrator and VPN-reachable credentials, and isolate affected hosts.
5. Patch Veeam and harden vCenter and ESXi access, since the reported attack chains target them.

Related free tool: planning network segmentation or access rules for exposed devices? Our Subnet Calculator shows network ranges, masks and usable hosts for any CIDR block.

Related coverage

• PAN-OS management interface RCE exploited (CVE-2026-0322)
• Rejetto HFS session forgery flaw probed in the wild (CVE-2026-61500)

Sources

• NVD: CVE-2026-0257
• Palo Alto Networks security advisory for CVE-2026-0257
• CISA KEV entry for CVE-2026-0257
• Help Net Security: Ransomware gangs have been exploiting Palo Alto GlobalProtect VPN flaw since June