Palo Alto VPN flaw still fuelling ransomware attacks after five months

An authentication bypass flaw in PAN-OS, the operating system behind Palo Alto Networks firewalls, is still being actively exploited by ransomware crews five months after it was patched. Unit 42, the vendor's own threat intelligence team, confirmed in updates on 19 and 20 October 2026 that the attacks are ongoing.

What the flaw does

Tracked as CVE-2026-0257, the flaw affects the GlobalProtect portal and gateway components of PAN-OS. An attacker can open a VPN session without valid credentials, and per Unit 42, multi-factor authentication can be bypassed along the same path. Palo Alto disclosed the issue and shipped a patch on 13 May 2026, and CISA added it to its Known Exploited Vulnerabilities catalogue the same day. Even so, Rapid7 reported successful exploitation across multiple customer environments dating back to 17 May.

Why it matters

The real risk is not the flaw itself but what follows it. In the incidents Unit 42 examined, attackers who gained VPN access surveyed the network with remote management tooling, moved laterally over RDP and SMB, harvested credentials, then deployed ransomware.

In one case they pivoted from the VPN gateway to VMware vCenter, switched off the execInstalledOnly control on ESXi hosts, and extracted credentials offline from a domain controller's virtual disk (VMDK) — a technique Unit 42 called highly sophisticated, since it sidesteps EDR agents inside the guest OS. The team also saw attackers chain this exploit with CVE-2023-27532 in Veeam backup infrastructure, putting the backup server inside the same attack path.

The groups behind the activity include Qilin and INC, and ReliaQuest Threat Research separately reported Settra ransomware operators exploiting the same flaw. Unit 42 said it has seen victims across 11 sectors, from education, financial services and healthcare to manufacturing, government, logistics and energy. No victim count has been published.

What this means for mid-sized businesses in Turkey

The pattern maps uncomfortably well onto a very common local setup: an internet-facing firewall terminating VPN connections, a virtualisation host behind it, a backup server and domain controller on the same network. One unpatched gateway hands an attacker the whole chain.

There is a compliance dimension too. Under Law No. 6698, personal data breaches must be reported to the Turkish data protection authority (KVKK) within 72 hours at the latest, and Law No. 7545 on cyber security adds obligations to implement security measures and report incidents. If a ransomware event also encrypts the backups, incident response turns from a technical problem into an administrative liability very quickly.

What we recommend at Kamer Bilişim

• Verify your firewall version this week. If you run PAN-OS, confirm a post-13 May 2026 patch is actually applied, and check whether the GlobalProtect management interfaces on ports 4443 and 3879 are reachable from the internet — the reported guidance is to restrict access to them. Run the same check on other vendors' VPN gateways; an unpatched gateway does not care about the brand on the chassis.
• Separate your backups from the production network. This chain being combined with a Veeam exploit shows the backup server is now a default target, not a last resort. At least one copy should live outside the domain, behind separate credentials, on immutable storage. A backup never test-restored is not a backup.
• Put the virtualisation and management layer in its own security zone. vCenter, ESXi and domain controller management interfaces should not be reachable from the user network or VPN address pool. Dedicated MFA for admin accounts, a jump host for management access, and central collection of authentication logs turn the attacker's most valuable step into their most expensive one.

We support businesses across the Anatolian side of Istanbul with firewall and VPN configuration, backup architecture and server maintenance, on site and remotely. To review how well your setup holds up against this attack chain, reach us through our contact page.

Source: The Register, 20 October 2026; Hackread, 22 October 2026; Palo Alto Networks Unit 42 updates, 19-20 October 2026.