Skip to content
Ransomware Groups Exploit Palo Alto VPN Vulnerability CVE-2026-0257

Ransomware Groups Exploit Palo Alto VPN Vulnerability CVE-2026-0257

First seen 12 Oct 2026, 10:29 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 12, 2026 at 11:29 UTC
  • •CVE-2026-0257 is actively exploited by ransomware groups despite a patch being available.
  • •The vulnerability affects several versions of PAN-OS and Prisma Access, with a CVSS score of 9.1.
  • •Organizations must upgrade their systems and enhance monitoring to detect unauthorized VPN access.

Ransomware groups, including Qilin and Settra, are exploiting a high-severity vulnerability (CVE-2026-0257) in Palo Alto Networks' PAN-OS GlobalProtect and Prisma Access products. This authentication bypass flaw allows attackers to create unauthorized VPN sessions, posing significant detection challenges as their traffic can mimic legitimate remote work. Despite a security patch released five months ago, multiple threat intelligence teams have reported ongoing exploitation attempts. The vulnerability was disclosed on May 13, 2026, and added to CISA's Known Exploited Vulnerabilities list on May 29, 2026. Organizations are urged to immediately upgrade affected systems and implement additional security measures to mitigate risks. Continuous monitoring and strong authentication controls are recommended to detect and prevent unauthorized access.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-05-13
CVE-2026-0257 published
Palo Alto Networks disclosed an authentication bypass vulnerability with a CVSS score of 7.8.
Infosecurity-Magazine
2026-05-29
CVE-2026-0257 added to CISA KEV list
CISA included the vulnerability in its Known Exploited Vulnerabilities list, urging remediation.
Infosecurity-Magazine
Recent
Ongoing exploitation confirmed
Threat intelligence teams reported active exploitation attempts by ransomware groups targeting the vulnerability.
Infosecurity-Magazine

More articles in this cluster (3)

Following this threat?

Track Qilin, Cobalt Strike and CVE-2026-0257 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (15)

1 / 4

Common questions

Which Palo Alto products are affected?
The vulnerability affects PAN-OS versions 10.2.0, 11.1.0, 11.2.0, 12.1.0, and Prisma Access versions 10.2.0 and 11.2.0.
What should organizations do to protect themselves?
Organizations should immediately upgrade affected systems, disable unnecessary authentication override cookies, and monitor for unusual VPN activity.
Is this vulnerability being actively exploited?
Yes, multiple ransomware groups are confirmed to be exploiting this vulnerability to gain unauthorized access.