Qilin and Inc ransomware crews break in through a Palo Alto VPN flaw
Palo Alto Networks fixed the GlobalProtect bypass in May. Its Unit 42 team now says ransomware operators are using it as a way in to virtual servers and backups, out of sight of endpoint tools
- CVE-2026-0257 carries a CVSS 4.0 base score of 7.8 (high)
- Exposure requires authentication override cookies to be enabled on a GlobalProtect portal or gateway
- Unit 42 names Qilin and Inc; public reporting adds Settra
- Sectors hit include financial services, healthcare, manufacturing, legal services and retail
Prisma Access, Palo Alto’s cloud-hosted service, is affected too, and the company says it is upgrading that service on a schedule shared with customers. A patch closes the bypass but does not remove an attacker who connected before it went on, so Unit 42 has published attacker IP addresses and device names to search for in GlobalProtect logs, and it calls for incident response on any match. Where the same intruders can also get to an unpatched Veeam server, the backups are exposed as well.
“Attackers are leveraging this vulnerability to gain an initial foothold into corporate networks”Andy Piazza, senior director of threat intelligence, Unit 42, Palo Alto Networks
Palo Alto Networks’ Unit 42 threat intelligence team said in research published on 20 October that the Qilin and Inc ransomware operations are exploiting CVE-2026-0257, an authentication bypass in the GlobalProtect VPN portal and gateway of the company’s PAN-OS firewall software. Palo Alto disclosed the flaw on 13 May and released fixed versions in the weeks that followed.
Unit 42 says the flaw lets an attacker open a VPN session without passing multifactor authentication. Unit 42, which has investigated intrusions linked to it since early June, describes attackers using remote monitoring and management (RMM) tools to map networks, then moving between machines over RDP and SMB before stealing data and deploying ransomware. Public reporting cited by Unit 42 links a third group, Settra, to the same flaw.
In one case, attackers moved from the compromised VPN gateway to the vCenter appliance that runs a company’s VMware servers, switched off security controls on the ESXi hosts and dumped credentials from a domain controller’s virtual disk. Unit 42 says the method avoids endpoint detection and response (EDR) tools running inside the virtual machines. Some intrusions were chained with CVE-2023-27532, a flaw in Veeam’s backup software.
The company’s advisory lists fixed releases across the 12.1, 11.2, 11.1 and 10.2 branches of PAN-OS and gives the bug its highest suggested urgency. Cloud NGFW and Panorama are not affected. The Register reported the ransomware activity on 20 October.
Sources
- Unit 42, Palo Alto Networks, “Active Exploitation of PAN-OS CVE-2026-0257”, threat research, Andy Piazza, 20 October 2026 (updated 19 and 20 October 2026). https://unit42.paloaltonetworks.com/active-exploitation-of-pan-os-cve-2026-0257/
- Palo Alto Networks, “CVE-2026-0257 PAN-OS: GlobalProtect Authentication Bypass Vulnerabilities”, security advisory, 13 May 2026 (updated 3 June 2026). https://security.paloaltonetworks.com/CVE-2026-0257
- Unit 42, “Andy Piazza”, author page, accessed 22 October 2026. https://unit42.paloaltonetworks.com/author/andy-piazza/
- The Register, “Palo Alto’s firewall OS has been under attack from multiple ransomware groups since June”, Jessica Lyons, 20 October 2026. https://www.theregister.com/cyber-crime/2026/10/20/palo-altos-firewall-os-has-been-under-attack-from-multiple-ransomware-groups-since-june/5304226
