Ransomware Groups Exploit Palo Alto VPN Vulnerability Despite Security Patch

A vulnerability in Palo Alto Networks equipment has continued to be exploited by ransomware groups even after the company released a security patch.

Palo Alto Networks' threat intelligence team, Unit 42, said on its website on Oct. 19 that ransomware groups Qilin and INC Ransom were exploiting a vulnerability in the company's firewall operating system, PAN-OS.

The vulnerability, identified as CVE-2026-0257, allows attackers to bypass authentication in GlobalProtect, the remote-access virtual private network (VPN) included in PAN-OS. Unauthorized actors exploiting the flaw can establish VPN connections without identity verification. It is equivalent to entering a building through its main entrance without presenting identification or a password at the security checkpoint. Palo Alto Networks released a patch after discovering the vulnerability in May.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its Known Exploited Vulnerabilities (KEV) catalog on May 29, indicating that it had also been used in ransomware attacks. The vulnerability carries a Common Vulnerability Scoring System (CVSS) severity score of 7.8 out of 10. Scores of 7 or higher are generally classified as high severity, while those of 9 or higher are considered critical. Palo Alto Networks initially rated the flaw at 4.7, or medium severity, before raising the score to 7.8.

Qilin and other attackers exploited the vulnerability to penetrate corporate networks, bypass multifactor authentication (MFA) and establish VPN connections. They then used remote monitoring and management (RMM) tools to examine internal networks and moved laterally through Remote Desktop Protocol (RDP) and Server Message Block (SMB) file-sharing connections. They also deployed tools for harvesting credentials, exfiltrating data and distributing ransomware. Their attacks targeted organizations across education, finance, healthcare, manufacturing and government.

Unit 42 identified direct movement into the virtualization layer as the most significant change in attacker behavior following successful exploitation of CVE-2026-0257.

Virtualization allows a single physical server to function as multiple virtual servers, much like dividing one building into several offices. The virtualization layer acts as the building's management office, creating and managing those individual spaces. Rather than breaking into each office separately, attackers effectively gained control of the management office.

In one case, attackers entered through a VPN connection and moved to vCenter, a virtual server management system. vCenter serves as the central management platform for ESXi, the software used to create and operate virtual servers.

The attackers disabled security settings designed to prevent unauthorized programs from running and accessed virtual disk files belonging to a domain controller. The files contained employee account information. Although an endpoint detection and response (EDR) solution was installed on the server, the attackers managed to bypass it.

Palo Alto Networks also issued an emergency patch on Oct. 14 after hackers exploited a zero-day vulnerability, CVE-2026-0322, in the operating system of customers' firewall equipment.

Qilin and INC Ransom were among eight groups identified by cybersecurity company Group-IB, which investigates and helps prevent digital crime, as ransomware groups to watch in 2026.

Qilin recorded 1,062 attacks in 2025 and 389 in the first quarter of 2026, the highest attack volume among the eight groups. Its primary tactic is double extortion, involving data theft followed by encryption. INC Ransom operates across 66 countries and more than 190 industries, recording 360 attacks in 2025 and 144 in the first quarter of 2026. The group is also known for applying psychological pressure by targeting law enforcement agencies, recovery companies and property and casualty insurers.