Palo Alto PAN-OS Auth Bypass Enables Ransomware Access Without MFA
Attackers use CVE-2026-0257 to bypass VPN security controls and deploy ransomware across multiple industries, according to Unit 42 reports.
Key points
- CVE-2026-0257 allows unauthorized VPN connections by bypassing authentication on GlobalProtect portals.
- Ransomware groups including Qilin and Inc have exploited the flaw since May.
- Unit 42 reports active investigations across finance, healthcare, and manufacturing sectors.
Attackers gain initial network access by establishing unauthorized VPN sessions through a high-severity authentication bypass in Palo Alto Networks' PAN-OS. This capability allows threat actors to circumvent multi-factor authentication controls, providing a direct foothold into corporate environments without valid credentials.
How it unfolded
- Palo Alto Networks disclosed and patched CVE-2026-0257 on May 13, initially rating it medium severity.
- Rapid7 researchers observed successful exploitation in customer environments dating back to May 17.
- Unit 42 confirmed ransomware groups like Qilin and Inc continued exploiting the flaw in early June.
Who is affected
Unit 42 is investigating compromises across numerous industries, including education, financial services, healthcare, high tech, hospitality, manufacturing, professional and legal services, government, transportation, utilities, energy, and retail. The vulnerability affects PAN-OS GlobalProtect portals and gateways, potentially allowing attackers to bypass security restrictions and establish unauthorized VPN connections.
View the original post on X
The fix
Palo Alto Networks released a patch for CVE-2026-0257 on May 13. The vendor initially stated it had not observed malicious exploitation but later acknowledged active abuse. Organizations should verify their PAN-OS versions are updated to the patched release to mitigate the authentication bypass risk.
What made it possible
Authentication bypass vulnerabilities often arise when input validation fails to enforce identity checks before granting access. In this scenario, the flaw allows an attacker to skip the verification stage entirely. Teams usually monitor for anomalous login patterns that lack corresponding credential submissions. Check whether network logs show VPN sessions established without standard authentication handshakes. This technique serves the initial access phase of an intrusion, enabling lateral movement tools to operate under the guise of legitimate remote connectivity.
What to do and how to stay safe: Palo Alto Networks
- Verify that all GlobalProtect portals and gateways are running the latest patched PAN-OS version.
- Review VPN session logs for connections that bypassed multi-factor authentication protocols.
- Monitor for lateral movement indicators such as unusual Remote Desktop Protocol or SMB activity.
- Isolate compromised endpoints immediately upon detecting unauthorized VPN sessions.
Step-by-step guide: DDoS Attack Mechanics: Answers to 10 Critical Questions
General security guidance from the RedTeam Tribune newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVE ID for this Palo Alto vulnerability?
The vulnerability is identified as CVE-2026-0257.
Which ransomware groups are exploiting this flaw?
Qilin and Inc are among the groups actively exploiting this vulnerability.
When was the patch released for CVE-2026-0257?
Palo Alto Networks released the patch on May 13.
