Ransomware gangs have been exploiting Palo Alto GlobalProtect VPN flaw since June

Multiple ransomware crews, including Qilin and INC, have been abusing CVE-2026-0257, a PAN-OS GlobalProtect authentication-bypass flaw patched by Palo Alto Networks in May, to infiltrate victims across healthcare, education, government and energy sectors since early June. The bug lets unauthenticated attackers forge a VPN session by exploiting weak cookie validation in GlobalProtect portals and gateways on physical and virtual firewalls, as well as in Prisma Access. Unit 42 and ReliaQuest report that intruders use the stolen access to sidestep MFA, move laterally with tools like Cobalt Strike and BloodHound, disable protections on vCenter/ESXi infrastructure to harvest domain credentials, and sometimes chain in a separate Veeam flaw (CVE-2023-27532) before deploying ransomware. Because the traffic rides over the organization's own VPN, the activity can blend in with legitimate remote work, and researchers warn exploitation will likely persist for months, urging immediate patching, disabling of unneeded auth-override cookies, and termination of all GlobalProtect sessions post-patch.