Palo Alto's firewall OS has been under attack from multiple ransomware groups since June
Unit 42 investigates network compromises across numerous industries
Since June, multiple ransomware groups, such as Qilin and Inc, have been targeting Palo Alto Networks' PAN-OS firewall operating system with a high-severity authentication bypass bug, according to security firm Unit 42. Unit 42 has been monitoring attacks across various industries, including finance, healthcare, and manufacturing.
The vulnerability, CVE-2026-0257, affects GlobalProtect portals and gateways, potentially enabling unauthorized VPN connections. Initially rated as medium severity, the issue was quickly deemed exploitable, with successful exploitation observed by May 17. Unit 42's Andy Piazza warns that attackers exploit this vulnerability to gain an initial foothold, bypass multi-factor authentication, and establish VPN sessions.
They then move laterally across networks, dropping additional malware for credential harvesting and data theft before deploying ransomware. Remediation is crucial, and Unit 42 advises organizations to check for infection indicators and investigate potential network access by the attackers.
Written by urgent.news from The Register's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
