Since early June, multiple ransomware groups such as Qilin and Inc have exploited a high-severity authentication bypass vulnerability in Palo Alto Networks' PAN-OS, affecting industries including finance and healthcare. Unit 42 continues to investigate ongoing attacks leveraging this vulnerability t
Since early June, multiple ransomware groups such as Qilin and Inc have exploited a high-severity authentication bypass vulnerability in Palo Alto Networks' PAN-OS, affecting industries including finance and healthcare. Unit 42 continues to investigate ongoing attacks leveraging this vulnerability to gain unauthorized access.
- The vulnerability CVE-2026-0257 impacts PAN-OS GlobalProtect portals and gateways allowing unauthorized VPN connections.
- Exploitation enables attackers to bypass multi-factor authentication and move laterally using RDP and SMB protocols.
- Ransomware groups have targeted sectors including education, government, transportation, and retail.
- Attackers use advanced techniques involving virtualization layers to steal domain-wide credentials undetected.
Why it matters
SMEs relying on PAN-OS for network security may face increased risks of unauthorized access and ransomware attacks, potentially impacting operational continuity and data protection. Understanding such vulnerabilities is crucial for assessing vendor security and enhancing internal cybersecurity measures to prevent lateral movement and credential theft.
Source: The Register
← All news
