Image: assets.infosecurity-magazine.com · rights & removal

Months-Old Palo Alto VPN Vulnerability Remains a Target for Ransomware Groups

Reporting by InfoSecurity MagazineRead the original at infosecurity-magazine.com

Executive Summary

Ransomware groups, including Qilin and Settra, are actively targeting CVE-2026-0257 in Palo Alto Networks products to establish unauthorized VPN sessions and gain initial access to internal networks. This vulnerability, an authentication bypass flaw in PAN-OS GlobalProtect and Prisma Access, was disclosed on May 13, 2026, and received a severity score of 7.8 (CVSS) from Palo Alto Networks and a critical rating of 9.1 from the NVD. Despite the release of fixed versions by Palo Alto, exploitation attempts have continued, evidenced by recent activity reported by threat intelligence teams such as Rapid7, Palo Alto’s Unit 42, and Artic Wolf. The threat actors are leveraging this access to mimic legitimate remote work traffic, potentially evading detection until lateral movement or ransomware deployment occurs.

Facts Only

* Ransomware groups target a high-severity vulnerability in Palo Alto Networks products.
* The vulnerability is CVE-2026-0257, an authentication bypass flaw in PAN-OS GlobalProtect and Prisma Access.
* Affected products include PAN-OS versions 10.2.0, 11.1.0, 11.2.0, 12.1.0, and Prisma Access versions 10.2.0 and 11.2.0.
* Palo Alto Networks disclosed the vulnerability on May 13, 2026, with a severity score of 7.8 (CVSS).
* The NVD allocated a critical severity rating of 9.1 to the flaw.
* Palo Alto released fixed versions for customer deployment.
* The vulnerability was added to CISA’s Known Exploited Vulnerabilities (KEV) list on May 29.
* Threat intelligence groups reported attempted exploitation, including by Rapid7 in late May, Palo Alto’s Unit 42 in June, and Artic Wolf in July.
* Ransomware groups Qilin and Settra are actively exploiting the flaw and deploying offensive security tools like Cobalt Strike, BloodHound, and SharpHound.
* The threat detection provider assessed a high likelihood that exploitation attempts will continue for the next three months.
* Organizations are advised to upgrade deployments, disable authentication override cookies where not required, terminate GlobalProtect sessions after patching, and investigate unexpected connections.

Full Take

The persistence of active exploitation five months after a patch release, coupled with the involvement of organized ransomware groups utilizing advanced offensive tooling, reveals a systemic failure in vulnerability lifecycle management rather than a simple technical oversight. The narrative shifts from a technical advisory about patching to an operational reality where neglected remediation provides a stable platform for malicious activity that leverages the inherent trust within VPN infrastructure. The emphasis placed on post-remediation actions—like disabling cookies and investigating connections—highlights a critical gap: access persistence is not solely mitigated by patching. This suggests that the vulnerability acts as a foundational entry vector, and subsequent security posture relies heavily on layered detective controls rather than singular preventative measures. Furthermore, the warning that malicious activity can mimic legitimate remote work introduces an important dimension regarding detection efficacy; this indicates that perimeter defense must be augmented by internal behavioral analysis to catch post-exploitation lateral movement before catastrophic outcomes like ransomware deployment occur. The implication is that security investment must pivot from reactive patching to continuous verification of session integrity and internal network behavior, acknowledging that access gained via a single flaw can translate directly into enterprise compromise regardless of the initial fix.
Bridge Questions: If patching alone does not remove pre-existing access, what corresponding architectural changes are necessary to enforce zero-trust principles across all VPN sessions? How can organizations effectively monitor for post-remediation persistence and lateral movement introduced by compromised authentication mechanisms? What governance structures are needed to ensure that high-severity vulnerability remediation moves from a reactive compliance checkbox to a proactive, continuously enforced operational mandate?

From the original · InfoSecurity Magazine

Ransomware groups continue to target a high-severity vulnerability in Palo Alto Networks products, despite a security patch being released five months ago, according to ReliaQuest.

Read the full story at infosecurity-magazine.com

Sentinel — Human

Confidence

The text functions as a factual report synthesizing vulnerability details, vendor warnings, and ongoing exploitation efforts by named threat groups, exhibiting characteristics of legitimate security reporting.

Signals Detected

Sentence length variance shows natural variation; the text flows like a report rather than a uniform cadence.

The argument builds logically from disclosure to exploitation, using specific source attributions (ReliaQuest, CISA).

Specific threat actors (Qilin, Settra) and tools (Cobalt Strike) are named alongside formal security bodies (NIST, CISA), suggesting grounding in specific threat reports.

The heavy reliance on specific CVE numbers, version numbers, and dates points towards data sourcing rather than pure fabrication.

Human Indicators

The integration of real-world entities (CVEs, threat groups, vendor advisories) implies grounding in external reporting, which is characteristic of human investigative journalism or deep technical analysis.