Ransomware crews turn PAN

Feeds.4Sysops •IT News • October 21, 2026

PAN-OS is the operating system that runs Palo Alto Networks’ -generation firewalls. Ransomware groups exploiting CVE-2026-0257 in Palo Alto Networks’ PAN-OS are reaching beyond VPN access: Unit 42 has seen attackers pivot to vCenter and ESXi to steal domain credentials while evading endpoint detection. Qilin, Inc, Settra, and other groups have used the authentication bypass to establish unauthorized VPN sessions, bypassing MFA and gaining a foothold in networks. Source

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Ransomware Groups Exploit Palo Alto VPN Flaw CVE-2026-0257 Ransomware groups Qilin and INC are exploiting CVE-2026-0257, a vulnerability in Palo Alto Networks' PAN-OS GlobalProtect VPN, to bypass authentication and gain unauthorized access to corporate networks. Despite a security patch released in May 2026, attackers have been exploiting this flaw since June, allowing them to establish VPN connections without identity verification. The vulnerability affects various sectors, including healthcare, education, and government, enabling attackers to steal domain credentials and deploy ransomware. Unit 42's investigations revealed that attackers are using remote monitoring tools to navigate networks and disable security controls on virtual servers. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has included this vulnerability in its Known Exploited Vulnerabilities catalog, indicating its. The severity of the vulnerability is rated at 7.8 out of 10 on the CVSS scale. 4 sources 71

Extracted Entities

Ransomware crews turn PAN

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)

MITRE ATT&CK (2)

Platforms (3)

Ransomware Groups (2)