# Ransomware Groups Exploiting Palo Alto VPN Vulnerability

*Published October 12, 2026*
*Source: [https://cybersecuritynews.com/palo-alto-globalprotect-flaw-vpn-access/](https://cybersecuritynews.com/palo-alto-globalprotect-flaw-vpn-access/)*

## Executive Summary

*This is a Premium edition. The Executive Summary is available to sec-news.ai members —*
*[read it here](https://www.sec-news.ai/news/ransomware-groups-exploiting-palo-alto-vpn-vulnerability) or [see plans](https://www.sec-news.ai/pricing).*

## Article

Ransomware groups are actively exploiting a critical flaw, CVE-2026-0257, in Palo Alto Networks' PAN-OS GlobalProtect and Prisma Access systems. This vulnerability allows attackers to bypass authentication, creating unauthorized VPN sessions that can lead to significant network intrusions. ReliaQuest has identified several threat groups, including Qilin and Settra, that are leveraging this flaw to infiltrate internal networks through trusted remote access services.

The nature of the attack poses a significant challenge for detection. Because attackers use the organization's own VPN, their activity can mimic legitimate remote work, complicating efforts to identify and mitigate the threat. During these unauthorized sessions, attackers have the opportunity to steal credentials, move laterally across systems, collect sensitive data, and potentially deploy ransomware before being detected.

Palo Alto Networks disclosed the vulnerability on May 13, 2026, assigning it a CVSS score of 7.8, indicating high severity. The vulnerability permits attackers without valid credentials to bypass security measures and establish unauthorized VPN connections. The issue primarily affects systems where GlobalProtect portals or gateways have authentication override cookies enabled with specific certificate configurations.

Not all deployments are affected but administrators are urged to verify their configurations against the vendor's fixed version table. Affected versions include PAN-OS 12.1, 11.2, 11.1, and 10.2, as well as Prisma Access 11.2 and 10.2. Notably, Panorama and Cloud NGFW are not impacted. Immediate upgrades are recommended to address the issue and prevent exploitation. Disabling unnecessary authentication override cookies and using newly generated certificates for these cookies are also advised.

Organizations should also terminate all active GlobalProtect sessions post-upgrade and investigate any anomalies, such as devices with suspicious hostnames, to ensure any unauthorized access is identified and mitigated. This vulnerability highlights the broader trend of ransomware attacks targeting VPN services, and organizations must remain vigilant to protect their networks against ongoing threats.