Palo Alto Networks’ Unit 42 says ransomware crews including Qilin and Inc have been exploiting CVE-2026-0257 since early June, across finance, healthcare, manufacturing and more.
The quick version
- The bug is an authentication bypass in PAN-OS GlobalProtect portals and gateways that can give attackers an unauthorized VPN connection.
- It was patched May 13 and first rated medium. Rapid7 saw successful exploitation dating back to at least May 17.
- Attackers get in, bypass MFA to set up a VPN session, move laterally with RDP and SMB, steal credentials and data, then deploy ransomware.
What I’d do
- If you run GlobalProtect and haven’t patched since May, do it today and assume you need to hunt for compromise.
- Look for odd VPN sessions and new RDP and SMB activity.
My take
“Medium” on day one doesn’t mean medium forever. Patch your edge devices fast.
Have a blessed day! And Happy Hacking!
