Skip to content
Ransomware Groups Exploit PAN-OS VPN Flaw for Domain Credential Theft

Ransomware Groups Exploit PAN-OS VPN Flaw for Domain Credential Theft

First seen 21 Oct 2026, 16:43 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 21, 2026 at 17:41 UTC
  • •CVE-2026-0257 allows unauthorized VPN access via an authentication bypass.
  • •Ransomware groups Qilin and Settra are actively exploiting this flaw since June 2026.
  • •Attackers can evade detection by using legitimate IT tools to navigate networks.

Ransomware groups are exploiting CVE-2026-0257, an authentication bypass in Palo Alto Networks’ PAN-OS GlobalProtect, to infiltrate various sectors including healthcare and government. The flaw allows attackers to bypass multi-factor authentication (MFA) and establish unauthorized VPN connections. Unit 42 has identified groups like Qilin and Settra using this vulnerability since June 2026, enabling them to pivot to vCenter and ESXi systems to steal domain credentials. Attackers leverage legitimate IT management tools to navigate networks undetected, leading to data theft and ransomware deployment. The vulnerability was initially rated medium severity but has since been recognized as a significant threat due to its exploitation. Organizations are urged to upgrade affected systems immediately to mitigate risks.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2023-03-10
CVE-2023-27532 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-05-13
CVE-2026-0257 published
Palo Alto Networks disclosed an authentication bypass vulnerability in PAN-OS GlobalProtect.
Helpnetsecurity
2026-05-29
CVE-2026-0257 added to CISA KEV
CISA added the vulnerability to its Known Exploited Vulnerabilities catalog due to active exploitation.
Helpnetsecurity
2026-10-19
Unit 42 updates threat brief
Unit 42 reported ongoing exploitation of CVE-2026-0257 by multiple ransomware groups.
Helpnetsecurity

More articles in this cluster (2)

Following this threat?

Track INC, Cobalt Strike and Education in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (23)

1 / 4

Common questions

Which systems are affected by CVE-2026-0257?
The vulnerability affects Palo Alto Networks' PAN-OS GlobalProtect portal and gateway on both physical and virtual firewalls.
How are attackers exploiting this vulnerability?
Attackers exploit the flaw to bypass MFA and establish unauthorized VPN sessions, allowing them to navigate networks undetected.
What should organizations do to protect themselves?
Organizations are advised to upgrade their PAN-OS deployments immediately to mitigate the risk of exploitation.