Ransomware crews exploit Palo Alto Networks firewall flaw

Ransomware operators including Qilin and Inc are using a PAN-OS GlobalProtect authentication bypass to create unauthorized VPN sessions, according to Unit 42. Defenders should patch CVE-2026-0257 and investigate compromise signs, including activity around vCenter and ESXi infrastructure.

Ransomware crews including Qilin and Inc are exploiting a Palo Alto Networks firewall flaw to create unauthorized VPN sessions and reach corporate networks, according to Unit 42.

The flaw, CVE-2026-0257, affects PAN-OS GlobalProtect portals and gateways. Attackers can bypass security restrictions, establish a VPN connection and skip multifactor authentication controls. Unit 42 has tracked the exploitation since early June across finance, healthcare, manufacturing and other sectors.

What the vulnerability allows

Palo Alto Networks disclosed and patched CVE-2026-0257 on May 13. The company rated the flaw medium severity and said it knew of exploitation attempts without finding evidence of malicious use at that point.

Rapid7 researchers found successful exploitation in several customer environments by May 17. That finding exposed a gap between the vendor's early assessment and the attacks taking place in the field.

Unit 42, Palo Alto Networks' consulting and incident response group, said Monday that Qilin and Inc had continued to exploit the flaw. ReliaQuest analysts also tied the vulnerability to Settra ransomware operators.

The Palo Alto Networks advisory for CVE-2026-0257 contains patch information and guidance for affected GlobalProtect configurations.

How the attack chain works

Attackers use the GlobalProtect authentication bypass to gain their first foothold in a corporate network. They then create an unauthorized VPN session that bypasses multifactor authentication, giving them access to internal systems without a successful password challenge.

After establishing the VPN connection, the criminals use Remote Desktop Protocol and Server Message Block to move among systems. They install tools for credential collection and data theft before deploying ransomware.

That sequence makes patching alone a narrow response. A patch closes the entry point, but an organization that exposed a vulnerable portal before updating may still have stolen credentials, active VPN sessions or unauthorized administrator accounts. Defenders need to treat every suspected exposure as a potential incident.

Unit 42 has found the activity across education, financial services, healthcare, high-tech, hospitality, manufacturing, professional services, government, transportation, logistics, utilities and retail. The company has not published a count of affected organizations.

The move into VMware virtualization

The attack chain has extended beyond ordinary lateral movement. Unit 42 found cases where attackers moved from a compromised VPN gateway to a VMware vCenter management appliance, disabled security controls on ESXi hypervisors through the execInstalledOnly setting and used a custom tool to dump credentials from a domain controller's virtual disk file.

This approach takes the attack outside the guest operating system. The criminals interact with the domain controller's virtual machine disk at the hypervisor layer, where endpoint detection and response products inside the guest may lack visibility. They can extract domain credentials without running a credential-stealing tool inside Windows, which weakens a common layer of enterprise defense.

A compromised vCenter server raises the risk because administrators use it to manage the hypervisors and virtual machines across a data center. An attacker with control over that management plane can gather broad information the estate and alter the security posture of the hosts beneath it. Unit 42 called the direct move from VPN to virtualization a major change in attacker tactics.

Use of older vulnerabilities

Unit 42 has also seen attackers chain CVE-2026-0257 with older flaws. One example is CVE-2023-27532, which affects Veeam backup infrastructure.

The GlobalProtect exploit provides network access, and the second vulnerability can weaken backup systems or expand the attackers' reach. Organizations that patched only the Veeam flaw remain exposed to the PAN-OS entry point. Organizations that patched only PAN-OS may still have an unremediated backup weakness.

Palo Alto Networks maintains a separate advisory for CVE-2023-27532 .

Defensive steps for network teams

Security teams should take the following actions:

Patch affected PAN-OS systems. Follow the official advisory for the fixed release and the required GlobalProtect configuration checks. Confirm the installed version from the management interface rather than relying on an inventory sheet.

Patch affected PAN-OS systems. Follow the official advisory for the fixed release and the required GlobalProtect configuration checks. Confirm the installed version from the management interface rather than relying on an inventory sheet.

Review GlobalProtect and authentication logs. for access that began around May 17 and through the attack window. Focus on successful VPN sessions, failed MFA challenges followed by successful access, unusual device fingerprints and activity tied to accounts that had no prior remote-access history.

Review GlobalProtect and authentication logs. for access that began around May 17 and through the attack window. Focus on successful VPN sessions, failed MFA challenges followed by successful access, unusual device fingerprints and activity tied to accounts that had no prior remote-access history.

Identify exposed portals and gateways. Inventory internet-facing GlobalProtect instances, including devices managed by cloud or service providers. The flaw affects portals and gateways, so a hidden appliance or forgotten test deployment can undermine the response.

Identify exposed portals and gateways. Inventory internet-facing GlobalProtect instances, including devices managed by cloud or service providers. The flaw affects portals and gateways, so a hidden appliance or forgotten test deployment can undermine the response.

Trace movement into management systems. Look for VPN sessions accessing vCenter, ESXi hosts, domain controllers, file servers and backup infrastructure. Review changes to execInstalledOnly and other ESXi security settings. Unit 42's threat research hub provides investigation material and indicators for threat hunting.

Trace movement into management systems. Look for VPN sessions accessing vCenter, ESXi hosts, domain controllers, file servers and backup infrastructure. Review changes to execInstalledOnly and other ESXi security settings. Unit 42's threat research hub provides investigation material and indicators for threat hunting.

Hunt for lateral movement. Review Remote Desktop Protocol and SMB activity between VPN-connected systems and critical servers. Unexpected remote administration, new administrative tools and bulk credential access deserve investigation.

Hunt for lateral movement. Review Remote Desktop Protocol and SMB activity between VPN-connected systems and critical servers. Unexpected remote administration, new administrative tools and bulk credential access deserve investigation.

Respond to suspected compromise. Isolate affected systems, revoke active VPN sessions, rotate exposed credentials and review privileged accounts. Preserve firewall, VPN, vCenter, ESXi, domain controller and endpoint logs before remediation alters the evidence.

Respond to suspected compromise. Isolate affected systems, revoke active VPN sessions, rotate exposed credentials and review privileged accounts. Preserve firewall, VPN, vCenter, ESXi, domain controller and endpoint logs before remediation alters the evidence.

The combination of a border-device bypass, stolen credentials and a hypervisor-level pivot makes this more than a GlobalProtect patching problem. Teams that patched the firewall without reviewing authentication logs, vCenter access and ESXi configuration changes may still carry an active attacker inside the network.

Source : theregister.com