PAN-OS GlobalProtect: CVE-2026-0257 exploited by Qilin and INC

Several ransomware groups, including Qilin and INC, are exploiting CVE-2026-0257, an authentication bypass vulnerability in the GlobalProtect portals and gateways of Palo Alto Networks PAN-OS. According to The Hacker News, the flaw also affects Prisma Access and has a CVSS score of 7.8. Exploitation allows an attacker to open an unauthorised VPN session, bypassing multi-factor authentication (MFA), and to use it as an entry point into the corporate network.

The new findings come from Unit 42, Palo Alto Networks’ consulting and incident response division, as reported by The Register and The Hacker News. The vulnerability has been fixed since May: anyone who has not updated yet is exposed, and anyone who updated late needs to check whether they have already been compromised.

What happened

The timeline comes from The Register:

• 13 May 2026: Palo Alto Networks publishes the advisory and the fix. At that point the severity is rated medium, and the vendor states it is aware of exploitation attempts but has not observed successful malicious exploitation.
• End of May: Rapid7 researchers report successful exploitation across multiple customer environments, dating back to at least 17 May.
• From early June: Unit 42 investigates attacks across many industries.
• 19 October: Unit 42 reports that ransomware groups, including Qilin and INC, continue to exploit the vulnerability.

According to Unit 42, the affected industries are education, financial services, healthcare, high tech, hospitality, manufacturing, professional and legal services, government, transportation and logistics, utilities and energy, and wholesale and retail. The number of affected organisations is not known: Palo Alto Networks did not answer The Register’s questions.

The Register also reports that, according to ReliaQuest analysts, the vulnerability is being exploited by multiple groups, including the operators of the Settra ransomware, again to gain initial access through unauthorised VPN sessions. This comes from a single source.

Technical details

• CVE: CVE-2026-0257, authentication bypass.
• Component: PAN-OS GlobalProtect portals and gateways; according to The Hacker News, Prisma Access as well.
• Severity: CVSS 7.8 according to The Hacker News (high); the vendor had initially rated it medium.
• Effect: an unauthorised VPN connection is established, with MFA bypassed.
• Versions: the available sources do not list the affected or fixed versions. The reference is Palo Alto Networks’ advisory on CVE-2026-0257.

The attack chain described by Unit 42

Andy Piazza, senior director of threat intelligence at Unit 42, describes this sequence:

1. Initial access: exploitation of CVE-2026-0257 and a VPN session opened without going through MFA.
2. Lateral movement over RDP and SMB.
3. Additional malware to harvest credentials and steal data.
4. Ransomware as the final stage.

The most significant evolution, again according to Unit 42, is the direct pivot to the virtualisation layer. In one case, the attackers moved from the compromised VPN gateway to the vCenter management appliance, disabled the execInstalledOnly control on ESXi hypervisors (which only allows binaries installed through signed packages to run) and used a custom tool to dump credentials offline from a domain controller’s virtual disk (VMDK). This avoids the EDR installed inside the virtual machines and yields domain-wide credentials.

Unit 42 has also seen the exploit chained with other vulnerabilities, such as CVE-2023-27532 in Veeam Backup & Replication, which targets backup infrastructure.

MITRE ATT&CK techniques

Our own mapping, based on Unit 42’s description as reported by the sources:

• T1190 Exploit Public-Facing Application and T1133 External Remote Services (access via VPN);
• T1021.001 Remote Desktop Protocol and T1021.002 SMB/Windows Admin Shares;
• T1562.001 Impair Defenses: Disable or Modify Tools (execInstalledOnly on ESXi);
• T1003 OS Credential Dumping (offline extraction from the VMDK);
• T1486 Data Encrypted for Impact.

Indicators

Unit 42 has published indicators of compromise for threat hunting; the sources available to us do not list them.

Impact for European and Italian companies

GlobalProtect is a widely used VPN in Europe and Italy too. The attack described hits two things many companies rely on for defence: MFA on the VPN and EDR on the machines. A VPN session opened through an authentication bypass can look like legitimate access; credential theft carried out on the virtual disk never passes through the EDR. VMware infrastructure and backups therefore become part of the perimeter to watch.

Healthcare, energy, transport and public administration, all among the affected industries, are also among those covered by NIS2. For these entities, CVE-2026-0257 should be prioritised in vulnerability management, and any compromise should be assessed as a significant incident to be notified to the national CSIRT (in Italy, CSIRT Italia at ACN). If personal data is involved, as is almost always the case in ransomware attacks with data theft, notification to the data protection authority within 72 hours under the GDPR must also be assessed.

What to do now

1. Take inventory of PAN-OS firewalls with GlobalProtect enabled and of Prisma Access tenants, including those managed by providers.
2. Update following Palo Alto Networks’ advisory on CVE-2026-0257, if you have not already done so.
3. Do not stop at the patch: exploitation has been documented since at least 17 May. Review GlobalProtect logs for VPN sessions from May onwards, looking for unexpected users, source addresses and times, and sessions without the expected MFA step.
4. Use Unit 42’s indicators to hunt across firewalls, endpoints and centralised logs.
5. Protect virtualisation: check that execInstalledOnly is enabled on every ESXi host, review access and changes on vCenter, and keep vCenter and ESXi management out of reach of the VPN address pools.
6. Check your backups: make sure Veeam Backup & Replication is patched for CVE-2023-27532 and that a copy of the data exists that cannot be reached from the main network.
7. Watch for lateral movement: unusual RDP and SMB connections originating from addresses assigned to the VPN.
8. If you find signs of compromise: preserve logs and evidence before acting, then reset domain credentials, virtualisation administrator credentials and VPN accounts.

How ARXDOME helps

ARX Sentry collects firewall logs in a central collector, so VPN sessions and logins stay recorded outside the device and can be reviewed retrospectively, and it has dedicated firewall pages showing firmware status. ARX Expose shows the services your company exposes on the internet, such as VPN portals, along with their known vulnerabilities. ARX Horizon enriches events with threat lists and vulnerability information.

Last updated: 20 October 2026