Ransomware groups are exploiting a Palo Alto Networks GlobalProtect flaw, the company's Unit 42 researchers say

As of 7:56 a.m. ET, Thursday, Oct. 22, 2026

Ransomware operators are exploiting an authentication bypass flaw in Palo Alto Networks' GlobalProtect VPN software to break into corporate networks, the company's Unit 42 threat research team said in an updated threat brief.

The vulnerability, CVE-2026-0257, is an authentication bypass in the portal and gateway components of vulnerable versions of PAN-OS software that "could allow unauthorized attackers to circumvent security controls and initiate virtual private network (VPN) connections," Unit 42 said.

Palo Alto Networks' security advisory for the flaw, first published May 13 and updated June 3, rates its severity 7.8, "HIGH." It says the issue affects firewalls with a GlobalProtect portal or gateway configured when authentication override cookies are enabled and a specific certificate configuration exists, and that the company "has become aware of limited exploit attempts on unpatched PAN-OS devices without mitigations applied."

Who is exploiting it

In an Oct. 19 update, Unit 42 said ransomware operators exploiting the flaw include groups it tracks as Spikey Scorpius, also known as Qilin, and Tarnished Scorpius, also known as Inc. It said public reporting also attributes exploitation to actors using Settra ransomware.

Attackers use the flaw to gain an initial foothold and bypass multi-factor authentication to set up a VPN session, then typically carry out internal reconnaissance with remote monitoring and management tools, move laterally over RDP and SMB, and stage tools for credential theft, data theft and "ultimately, ransomware deployment," according to the brief.

"Our investigations have been ongoing since early June 2026," Unit 42 said, listing industries including education, financial services, health care, manufacturing, government, transportation, utilities, and wholesale and retail.

In one case, attackers moved from the compromised VPN gateway to a vCenter management appliance, disabled security controls on ESXi hypervisors and dumped credentials offline from a domain controller's virtual disk, a method that bypasses endpoint detection tools, Unit 42 said. It said it has also seen actors chain the access with exploits for Veeam backup software (CVE-2023-27532).

What to do

Unit 42 urged organizations to review Palo Alto Networks' security advisory for CVE-2026-0257 and apply the workarounds and mitigations or upgrade to a fixed version, and to hunt their GlobalProtect logs for the indicators listed in its brief.

What is not known

Unit 42 did not say how many organizations have been breached through the flaw.