Patched in May, Palo Alto VPN flaw still opens the door to ransomware

A GlobalProtect VPN flaw in Palo Alto Networks' PAN-OS firewall software is still serving as an entry point for ransomware crews, more than five months after a patch was released. The bug, tracked as CVE-2026-0257, is an authentication bypass: because the firewalls accept cookies without proper integrity checking, a remote attacker with no credentials can establish an unauthorised VPN session.

Palo Alto Networks disclosed the flaw and shipped a fix on 13 May 2026, rating it medium severity at the time. The flaw now carries a CVSS 4.0 score of 7.8 (high) and was added to CISA's Known Exploited Vulnerabilities catalogue on 29 May. Rapid7 reported successful exploitation in customer environments from 17 May onward. Unit 42, Palo Alto's own incident response team, has been investigating intrusions tied to the bug since early June. In a threat brief updated on 19 October, Unit 42 named the Qilin and Inc ransomware operations; security firm ReliaQuest separately linked Settra operators and initial access brokers to the same flaw.

Why this matters

Attackers are not stopping at the perimeter. According to Unit 42, once a VPN session is established, multi-factor authentication is bypassed, intruders move laterally using legitimate IT management tooling, and credential- and data-theft utilities are deployed before ransomware is ever launched. In one documented case, attackers pivoted from the VPN gateway to a vCenter appliance, disabled security controls on ESXi hypervisors, and extracted credentials offline from a domain controller's virtual disk.

The sharpest warning comes from ReliaQuest: patching does not remove access that was established before the fix was applied. Because the access arrives through the organisation's own VPN, the traffic looks like ordinary remote work and rarely stands out on a standard monitoring dashboard. ReliaQuest considers continued exploitation over the next three months highly likely.

What it means for businesses in Türkiye

This is not only a Palo Alto story. Across Istanbul's Anatolian side, small and mid-sized companies, construction offices, shipping agencies and logistics firms connect field staff, finance teams and managers to the office through SSL VPN running on a firewall appliance. These devices are typically configured once and then forgotten, and updates labelled medium severity drift to the bottom of the queue. CVE-2026-0257 shows exactly where that habit leads: a flaw rated medium in May was reported in October as the way in for ransomware campaigns.

There is a compliance dimension too. If a VPN-borne intrusion exposes personal data, Turkish Law No. 6698 requires notifying the Data Protection Authority without undue delay and in any case within 72 hours. In that review, "we applied the update late" reads as a missing technical safeguard, not as an excuse.

What we recommend at Kamer Bilişim

• Terminate every VPN session after patching. Installing the update is not the finish line. Close active SSL VPN sessions, rotate passwords for VPN-enabled accounts and any client certificates, and disable authentication override cookie features you do not need.
• Run a backward-looking log review. Search VPN logs from May to today for unexpected account-and-device pairings, unusual geographies and client hostnames you do not recognise. Access established before the patch surfaces only this way.
• Put updates on a calendar instead of a severity rating. Set a monthly patch cycle and a quarterly configuration review for every internet-facing device, close management interfaces that do not need to be exposed, and segment VPN access away from domain controllers, hypervisor management and backup servers.

If you are not certain your firewall and VPN configuration is current, we are happy to review it with you. You can reach us through our contact page.

Source: eSecurity Planet, Help Net Security, The Register, Palo Alto Networks Unit 42