Multiple ransomware groups have been exploiting a vulnerability in Palo Alto Networks’ PAN-OS firewall software since June, according to an updated Unit 42 threat report. The authentication bypass flaw, CVE-2026-0257, allows attackers to establish unauthorized VPN connections and bypass multifactor authentication.
Unit 42 identified Qilin and INC ransomware operators exploiting the vulnerability, with additional reports linking Settra ransomware to the attacks. Investigations span healthcare, financial services, manufacturing, government, energy and other industries.
Once inside corporate networks, attackers have moved laterally, harvested credentials and deployed ransomware. In one case, attackers accessed VMware vCenter, disabled ESXi security controls and extracted domain credentials directly from a virtual disk, bypassing endpoint security tools.
Palo Alto Networks patched the vulnerability in May and recommends that organizations update affected systems and investigate potential compromises.
Jacob Krell, Senior Director: Secure AI Solutions & Cybersecurity, Suzu Labs:
“Security appliances are now one of the most consistently exploited category of enterprise technology, and the Qilin and INC ransomware crews working a Palo Alto Networks PAN-OS authentication bypass since June is the pattern repeating, not an anomaly. The devices organizations buy to defend the perimeter have become the most productive way through it. When I analyzed CISA’s Known Exploited Vulnerabilities (KEV) catalog in July, security and network infrastructure vendors accounted for over a quarter of actively exploited entries in the first half of 2026, with 75 entries flagged as ransomware entry points and Palo Alto Networks holding 6 of them. An appliance is internet-facing by design, holds elevated network trust, and runs closed software no endpoint agent watches, so the compromise is invisible to the security stack because the compromised device is the security stack. That is how attackers reached vCenter, disabled ESXi controls, and pulled domain credentials without tripping a single tool. Treat the firewall as an adversary-accessible endpoint, and segment so a compromised gateway cannot reach everything behind it.”
ㅤ
Darin Fredde, Sr. Director of Technical Marketing Engineering, Ridge Security:
“It’s never good to see this happen to anyone, especially a respected industry leader like Palo Alto Networks. But this incident highlights a much broader challenge facing our industry. In the post-Mythos era of AI-accelerated vulnerability discovery, we no longer have the luxury of relying on point-in-time security assessments. We must accelerate proactive offensive testing and, equally important, remediation and independent verification to keep pace with evolving threats. This doesn’t eliminate the need for experienced security professionals. Quite the opposite. It amplifies their importance while demanding better tools and automation to operate at scale. The attackers’ reported movement from VPN access into virtualization infrastructure also reminds us that security must be validated across the entire architecture, not just individual controls. Ultimately, discovering vulnerabilities faster means little if we cannot fix them just as effectively. Otherwise, we’re simply getting better at finding problems we haven’t solved.”
Besides patching all the things, this is not good as a lot of people depend on Palo Alto firewalls. Thus this is a today problem.
Related
This entry was posted on October 21, 2026 at 3:18 pm and is filed under Commentary with tags Palo Alto Networks. You can follow any responses to this entry through the RSS 2.0 feed.
You can leave a response, or trackback from your own site.
Ransomware groups exploit Palo Alto Networks firewall
Multiple ransomware groups have been exploiting a vulnerability in Palo Alto Networks’ PAN-OS firewall software since June, according to an updated Unit 42 threat report. The authentication bypass flaw, CVE-2026-0257, allows attackers to establish unauthorized VPN connections and bypass multifactor authentication.
Unit 42 identified Qilin and INC ransomware operators exploiting the vulnerability, with additional reports linking Settra ransomware to the attacks. Investigations span healthcare, financial services, manufacturing, government, energy and other industries.
Once inside corporate networks, attackers have moved laterally, harvested credentials and deployed ransomware. In one case, attackers accessed VMware vCenter, disabled ESXi security controls and extracted domain credentials directly from a virtual disk, bypassing endpoint security tools.
Palo Alto Networks patched the vulnerability in May and recommends that organizations update affected systems and investigate potential compromises.
Jacob Krell, Senior Director: Secure AI Solutions & Cybersecurity, Suzu Labs:
“Security appliances are now one of the most consistently exploited category of enterprise technology, and the Qilin and INC ransomware crews working a Palo Alto Networks PAN-OS authentication bypass since June is the pattern repeating, not an anomaly. The devices organizations buy to defend the perimeter have become the most productive way through it. When I analyzed CISA’s Known Exploited Vulnerabilities (KEV) catalog in July, security and network infrastructure vendors accounted for over a quarter of actively exploited entries in the first half of 2026, with 75 entries flagged as ransomware entry points and Palo Alto Networks holding 6 of them. An appliance is internet-facing by design, holds elevated network trust, and runs closed software no endpoint agent watches, so the compromise is invisible to the security stack because the compromised device is the security stack. That is how attackers reached vCenter, disabled ESXi controls, and pulled domain credentials without tripping a single tool. Treat the firewall as an adversary-accessible endpoint, and segment so a compromised gateway cannot reach everything behind it.”
ㅤ
Darin Fredde, Sr. Director of Technical Marketing Engineering, Ridge Security:
“It’s never good to see this happen to anyone, especially a respected industry leader like Palo Alto Networks. But this incident highlights a much broader challenge facing our industry. In the post-Mythos era of AI-accelerated vulnerability discovery, we no longer have the luxury of relying on point-in-time security assessments. We must accelerate proactive offensive testing and, equally important, remediation and independent verification to keep pace with evolving threats. This doesn’t eliminate the need for experienced security professionals. Quite the opposite. It amplifies their importance while demanding better tools and automation to operate at scale. The attackers’ reported movement from VPN access into virtualization infrastructure also reminds us that security must be validated across the entire architecture, not just individual controls. Ultimately, discovering vulnerabilities faster means little if we cannot fix them just as effectively. Otherwise, we’re simply getting better at finding problems we haven’t solved.”
Besides patching all the things, this is not good as a lot of people depend on Palo Alto firewalls. Thus this is a today problem.
Share this:
Like this:
Related
This entry was posted on October 21, 2026 at 3:18 pm and is filed under Commentary with tags Palo Alto Networks. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.