Multiple ransomware groups have been exploiting a high severity authentication bypass bug in Palo Alto Networks’ PAN-OS since early June, the company’s incident response unit, Unit 42, said on Monday. CVE-2026-0257 affects GlobalProtect portals and gateways and can let an attacker establish an unauthorised VPN connection.
Palo Alto Networks first disclosed and patched the bug on May 13, initially rating it medium severity and saying it was aware of exploitation attempts but had not observed malicious exploitation. That assessment changed within the month: Rapid7 researchers reported successful exploitation across multiple customer environments dating back to at least May 17.
“Attackers are leveraging this vulnerability to gain an initial foothold into corporate networks, subsequently bypassing multi-factor authentication (MFA) controls to establish a VPN session,” said Andy Piazza, a senior director of threat intelligence at Unit 42. After access, attackers move laterally using Remote Desktop Protocol and Server Message Block, drop credential harvesting malware and steal data before deploying ransomware. In one case Unit 42 described, attackers pivoted from the VPN gateway to the vCenter management appliance and disabled security controls on ESXi hypervisors to dump credentials from a domain controller’s virtual disk, bypassing endpoint detection inside the guest systems.
Unit 42 said it has investigated intrusions across numerous industries, including education, financial services, healthcare, high tech, hospitality, manufacturing, professional and legal services, government, transportation and logistics, utilities and energy, and wholesale and retail. Palo Alto Networks did not tell The Register how many organisations have been infected. Separate ReliaQuest reporting links the Settra operation to the same flaw and expects exploitation to continue while unpatched firewalls remain exposed.