Ransomware groups spent months exploiting Palo Alto firewall bug, Unit 42 warns

Authentication bypass in PAN-OS GlobalProtect has been used to reach corporate networks, disable security controls and steal credentials since May

By LineZotpaper

Published20 October 2026

Read Time2 min

Multiple ransomware groups, including Qilin, Inc and Settra, have been exploiting a high-severity authentication bypass in Palo Alto Networks' PAN-OS firewall software for months, the vendor's incident response unit says, gaining initial access to corporate networks, bypassing multi-factor authentication and, in some cases, moving directly into the virtualisation layer to disable security controls.

The vulnerability, tracked as CVE-2026-0257, affects PAN-OS GlobalProtect portals and gateways and could allow attackers to bypass security restrictions and establish an unauthorised VPN connection, Palo Alto Networks said when it disclosed and patched the bug on May 13. The company initially rated it medium severity and said it was aware of attempts to exploit it, but by the end of the month Rapid7 researchers said they had observed successful exploitation across multiple customer environments dating back to at least May 17.

On Monday, Palo Alto Networks' consulting and incident response business, Unit 42, said ransomware crews including Qilin and Inc continue to target the flaw. "Attackers are leveraging this vulnerability to gain an initial foothold into corporate networks, subsequently bypassing multi-factor authentication (MFA) controls to establish a VPN session," said Andy Piazza, a senior director of threat intelligence at Unit 42.

After gaining access, attackers move laterally across networks using Remote Desktop Protocol and Server Message Block, dropping additional malware for credential harvesting and data theft before deploying ransomware, Piazza said. Unit 42 investigations have found infections across education, financial services, healthcare, high tech, hospitality, manufacturing, professional and legal services, government, transportation and logistics, utilities and energy, and wholesale and retail.

ReliaQuest analysts separately warned that "multiple threat groups," including Settra ransomware operators, are exploiting the bug to gain initial access via unauthorised VPN sessions.

Piazza highlighted what he called the most significant evolution in tactics: a direct pivot to the virtualisation layer. In one case, attackers moved from a compromised VPN gateway to a vCenter management appliance, disabled security controls on ESXi hypervisors, and used a custom tool to perform offline credential dumping against a domain controller's virtual disk, bypassing in-guest endpoint detection and response products. Unit 42 has also seen the flaw chained with CVE-2023-27532, which targets Veeam backup infrastructure.

Palo Alto Networks did not respond to The Register's inquiries, including how many organisations have been infected. Unit 42 has published indicators of compromise to assist with threat hunting.

Analysis

Why This Matters

PAN-OS firewalls sit at the edge of many corporate networks, so an authentication bypass in GlobalProtect can hand attackers a trusted entry point.
The exploitation has been underway since at least May, giving ransomware crews months to move laterally, steal credentials and encrypt systems.
Attackers are now disabling security controls inside virtualisation layers, which can let them gather domain-wide credentials without being detected by endpoint software.

Background

PAN-OS is Palo Alto Networks' firewall operating system, widely used by enterprises for network security and remote access through GlobalProtect VPN portals and gateways. The flaw disclosed in May is an authentication bypass in that remote-access component. The vendor's initial medium-severity rating was revised in practice as security researchers observed active exploitation, and the campaign has continued to evolve since.

Key Perspectives

Palo Alto Networks and Unit 42: The vendor's incident response team describes an ongoing, active campaign and urges organisations to patch vulnerable software, investigate whether attackers have already gained access, and use published indicators of compromise for threat hunting.

ReliaQuest analysts: They independently warn that multiple threat groups beyond the named crews, including Settra, are exploiting the same bug, broadening the scope of the campaign beyond what Unit 42 alone has documented.

Defenders and affected organisations: For enterprises running unpatched PAN-OS, the risk includes MFA bypass, credential theft and ransomware deployment. Unit 42's findings suggest that even patched environments should check for signs of earlier intrusion, given evidence of exploitation dating back to mid-May.

What to Watch

Further Unit 42 or ReliaQuest disclosures on the scale of infections and any additional ransomware groups using the flaw.
Whether attackers continue chaining CVE-2026-0257 with other vulnerabilities, such as the Veeam backup flaw CVE-2023-27532.
Reports of attacks that move beyond VPN gateways into hypervisor and virtualisation layers, a technique Unit 42 said marks the most significant tactical shift so far.

Sources

Palo Alto's firewall OS has been under attack from multiple ransomware groups since June · www.theregister.com - Articles

Checked

12 claims in this story checked against 1 source: 10 supported.

Show each claim

SupportedMultiple ransomware groups had exploited the flaw for months, and Unit 42 warned of the activity.www.theregister.com - Articles: “Multiple ransomware groups, including Qilin and Inc, have been exploiting a high-severity authentication bypass bug in Palo Alto Networks' PAN-OS, with Unit 42 investigating attacks since early June”
Partly supportedUnit 42 says Qilin, Inc and Settra have all been exploiting the flaw for months.www.theregister.com - Articles: “On Monday, Palo Alto Networks’ consulting and incident response biz, Unit 42, said ransomware crews including Qilin and Inc continue to batter the CVE. Additionally, ReliaQuest intel analysts warned that “multiple threat groups,” including Settra ransomware operators, are also exploiting the bug”
Partly supportedThe flaw has been used since May to reach corporate networks, disable security controls and steal credentials.www.theregister.com - Articles: “Rapid7 researchers said they observed successful exploitation across multiple customer environments dating back to at least May 17. ... they disabled security controls on ESXi hypervisors ... and used a custom tool to perform offline credential dumping”
SupportedAndy Piazza said attackers leverage the vulnerability to gain an initial foothold, bypass MFA controls and establish a VPN session.www.theregister.com - Articles: ““Attackers are leveraging this vulnerability to gain an initial foothold into corporate networks, subsequently bypassing multi-factor authentication (MFA) controls to establish a VPN session,” said Andy Piazza, a senior director of threat intelligence at Unit 42.”
SupportedPalo Alto Networks disclosed and patched the vulnerability on May 13.www.theregister.com - Articles: “The security vendor first disclosed and patched the bug on May 13”
SupportedThe company initially rated the bug medium severity and said it was aware of attempts to exploit it.www.theregister.com - Articles: “The security vendor first disclosed and patched the bug on May 13 and initially assigned it a medium-severity rating, saying it was aware of attempts to exploit it but had not observed any malicious exploitation.”
SupportedRapid7 researchers reported successful exploitation across customer environments dating back to at least May 17.www.theregister.com - Articles: “by the end of the month, Rapid7 researchers said they observed successful exploitation across multiple customer environments dating back to at least May 17.”
SupportedAfter initial access, attackers moved laterally using RDP and SMB and dropped malware for credential harvesting and data theft before deploying ransomware.www.theregister.com - Articles: “After gaining initial access, the criminals move laterally across the networks using Remote Desktop Protocol and Server Message Block (SMB), dropping additional malware for credential harvesting and data theft before ultimately deploying ransomware, Piazza warned.”
SupportedUnit 42 investigations found infections across the listed industries.www.theregister.com - Articles: “In its ongoing investigations, Unit 42 has spotted the ransomware criminals infecting “numerous industries, including education, financial services, healthcare, high tech, hospitality, manufacturing, professional and legal services, government, transportation and logistics, utilities and energy, and wholesale and retail.””
SupportedIn one case, attackers moved from a compromised VPN gateway to vCenter, disabled ESXi security controls and used a custom tool to dump credentials from a domain controller’s virtual disk, bypassing in-guest EDR.www.theregister.com - Articles: ““In one notable case, attackers moved from the compromised VPN gateway to the vCenter management appliance. From there, they disabled security controls on ESXi hypervisors (execInstalledOnly) and used a custom tool to perform offline credential dumping directly against a domain controller's virtual disk (VMDK).” This allows the miscreants to bypass in-guest endpoint detection and response products”
SupportedUnit 42 has seen the flaw chained with CVE-2023-27532, which targets Veeam backup infrastructure.www.theregister.com - Articles: “Unit 42 has also spotted criminals chaining this exploit for initial access with other vulnerabilities such as CVE-2023-27532, which targets Veeam backup infrastructure.”
SupportedPalo Alto Networks did not respond to The Register’s inquiries, including about how many organisations had been infected.www.theregister.com - Articles: “Palo Alto Networks did not respond to The Register’s inquiries about the attacks, including how many organizations have been infected.”