Ransomware gangs are exploiting a flaw in Palo Alto Networks' GlobalProtect VPN to break into organizations, months after it was published and fixed. According to Cybersecurity Dive, Palo Alto's own Unit 42 identified the Qilin and INC gangs, and ReliaQuest also linked a group called Settra to the activity.
The flaw
The flaw, CVE-2026-0257, allows bypassing authentication at the VPN gateway and affects several versions of the PAN-OS operating system. It was published on May 13 and added to CISA's known exploited vulnerabilities list in late May. Palo Alto initially rated it medium severity, and only later raised the rating.
How the attack unfolds
After getting in, the attackers use legitimate management tools to explore the network, move between machines and steal passwords and data, and only at the end deploy ransomware. According to Arctic Wolf, several different affiliates operating under Qilin's ransomware-as-a-service model are exploiting the flaw, not one coordinated group.
What to do
According to ReliaQuest, exploitation is "highly likely" to continue over the next three months. Organizations using GlobalProtect should make sure the update is installed and, per Palo Alto's guidance, also terminate all active sessions after patching and disable unneeded authentication cookies. Palo Alto, founded by Israeli Nir Zuk and which acquired Israel's CyberArk, is one of the world's largest network security vendors.
