Ransomware Groups Exploit Palo Alto Networks PAN-OS Authentication Bypass
Attackers leverage CVE-2026-0257 to bypass MFA and compromise enterprise virtualization layers.
1Vulnerability Scope and Origins
The high-severity vulnerability, identified as CVE-2026-0257, affects Palo Alto Networks' PAN-OS GlobalProtect portals and gateways. Initially disclosed and patched on May 13, the flaw allows attackers to bypass security restrictions. While initially rated as medium-severity, subsequent evidence confirmed active exploitation across multiple customer environments dating back to at least May 17.
2Active Ransomware Campaign Tactics
Unit 42 reports that multiple ransomware crews, including Qilin and Inc, are actively exploiting this flaw. Attackers use the vulnerability to gain an initial foothold into corporate networks, effectively bypassing multi-factor authentication controls. Once inside, they establish unauthorized VPN sessions to facilitate further malicious activities, including lateral movement across the target infrastructure.
3Lateral Movement and Malware Deployment
After gaining initial access, criminals move laterally using Remote Desktop Protocol and Server Message Block protocols. They deploy additional malware designed for credential harvesting and data theft before executing final ransomware payloads. This systematic approach allows attackers to compromise sensitive internal systems across a wide range of sectors, including healthcare, manufacturing, and finance.
4Advanced Virtualization Layer Attacks
A significant evolution in attacker tactics involves pivoting directly to the virtualization layer. In specific cases, threat actors moved from compromised VPN gateways to vCenter management appliances. By disabling security controls on ESXi hypervisors, they utilized custom tools to perform offline credential dumping directly against domain controller virtual disks, bypassing standard endpoint detection.
5Chaining Vulnerabilities for Access
Unit 42 has observed threat actors chaining the PAN-OS exploit with other known vulnerabilities to maximize impact. Specifically, attackers are combining this initial access method with CVE-2023-27532, which targets Veeam backup infrastructure. This multi-stage approach demonstrates a sophisticated level of planning, allowing criminals to compromise critical backup systems alongside primary corporate network environments.
6Broad Industry Impact Observed
The exploitation campaign is widespread, impacting numerous industries globally. Affected sectors include education, hospitality, professional services, government, transportation, logistics, utilities, and energy. Despite the breadth of these attacks, Palo Alto Networks has not disclosed the specific number of organizations infected, leaving the full scale of the compromise currently unquantified by the vendor.
7Additional Threat Actor Involvement
Beyond Qilin and Inc, other threat groups are actively participating in this campaign. ReliaQuest intel analysts confirmed that operators such as Settra are also leveraging the CVE-2026-0257 vulnerability to gain unauthorized network access. This indicates a broader ecosystem of cybercriminals coordinating or independently capitalizing on the same security flaw to conduct ransomware operations.
8Urgent Remediation and Investigation
Organizations must prioritize patching vulnerable PAN-OS software immediately to mitigate further risk. Beyond patching, security teams should conduct thorough investigations to determine if attackers have already gained network access. Utilizing Unit 42’s published indicators of compromise is essential for effective threat-hunting activities to detect and neutralize any existing unauthorized presence within the environment.