Palo Alto's firewall OS has been under attack from multiple ransomware groups since June
A high-severity authentication bypass vulnerability (CVE-2026-0257) in Palo Alto Networks' PAN-OS GlobalProtect portals and gateways has been exploited by multiple ransomware groups to gain initial network access since early June. Attackers bypass MFA controls and establish unauthorized VPN connections, then move laterally using RDP and SMB to deploy additional malware for credential theft and data exfiltration. The vulnerability impacts organizations across finance, healthcare, and manufacturing sectors.
Key points
- Multiple ransomware groups exploiting CVE-2026-0257 since June
- Vulnerability allows authentication bypass and unauthorized VPN access
- Attackers bypass MFA and move laterally to harvest credentials
- Impacts finance, healthcare, and manufacturing industries
Summary and key points written by AI from the headline and a short excerpt, so they can be incomplete or wrong. The Register did the reporting; read the original for the full story.
Read the full story at The Register
