Palo Alto's PAN-OS auth bypass has been under active ransomware exploitation since June, Unit 42 says, with Qilin and Inc hitting finance, healthcare and manufacturing. CVE-2026-0257 lets attackers by

What happened: Multiple ransomware groups including Qilin and Inc are exploiting a high-severity authentication bypass bug, CVE-2026-0257, in Palo Alto Networks' PAN-OS GlobalProtect portals and gateways, with Unit 42 investigating attacks since early June. Key numbers: CVE-2026-0257 was disclosed and patched on May Why it matters: Attackers use the flaw to bypass MFA and establish VPN sessions, then move laterally via RDP and SMB to steal credentials and deploy ransomware. Unit 42 also reported a pivot to the virtualization layer, including a case reaching a vCenter management appliance.

Multiple ransomware groups including Qilin and Inc are exploiting a high-severity authentication bypass bug, CVE-2026-0257, in Palo Alto Networks' PAN-OS GlobalProtect portals and gateways, with Unit 42 investigating attacks since early June.

Attackers use the flaw to bypass MFA and establish VPN sessions, then move laterally via RDP and SMB to steal credentials and deploy ransomware. Unit 42 also reported a pivot to the virtualization layer, including a case reaching a vCenter management appliance.