Ransomware Groups Exploit Vulnerabilities in Palo Alto Networks Products Despite Available Patches
Recent cybersecurity insights from ReliaQuest have raised alarms regarding the ongoing exploitation of a critical vulnerability within Palo Alto Networks’ products. Despite a security patch being released five months ago, ransomware groups, notably the Qilin and Settra operations, have been actively targeting this vulnerability, identified as CVE-2026-0257, to gain unauthorized access to internal networks.
CVE-2026-0257 pertains to an authentication bypass vulnerability impacting PAN-OS GlobalProtect and Prisma Access. This flaw affects several versions of Palo Alto Networks’ products, including PAN-OS versions 10.2.0, 11.1.0, 11.2.0, and 12.1.0, as well as two iterations of Prisma Access (10.2.0 and 11.2.0). The discovery of this vulnerability was made public by Palo Alto Networks on May 13, 2026, at which time it was assigned a severity score of 7.8 on the Common Vulnerability Scoring System (CVSS), categorizing it as a significant threat. Moreover, the US National Vulnerability Database (NVD), part of the National Institute of Standards and Technology (NIST), rated this flaw with an even higher critical severity score of 9.1.
Upon disclosing the vulnerability, Palo Alto Networks advised customers to promptly deploy the fixed versions in order to mitigate potential threats. The company acknowledged awareness of limited exploit attempts on unpatched PAN-OS devices lacking the necessary mitigations. As part of proactive cybersecurity efforts, CVE-2026-0257 was included in the US Cybersecurity and Infrastructure Security Agency’s (CISA) Known Exploited Vulnerabilities (KEV) list on May 29, with a stringent call for federal agencies to implement remediation measures by June 1.
Despite these efforts, many systems appear unpatched, as numerous threat intelligence teams have reported exploitation attempts related to CVE-2026-0257 over the past few months. Instances of active exploitation have been recorded by various cybersecurity organizations; for example, Rapid7 reported such activities in late May, while Palo Alto’s Unit 42 team provided insights in June, and Arctic Wolf identified ongoing exploits in July. These findings underline the critical need for prompt and effective user action on vulnerabilities.
Immediate Action Required for Vulnerable Organizations
In light of these developments, ReliaQuest emphasizes the urgent need for organizations still operating vulnerable Palo Alto products to take decisive action. The firm has indicated that ransomware groups, including Qilin and Settra, are not only exploiting the CVE-2026-0257 vulnerability but are also deploying advanced offensive security tools such as Cobalt Strike, BloodHound, and SharpHound. ReliaQuest has assessed the likelihood of continued exploitation attempts by these groups to remain high over the next three months.
The nature of the exploited vulnerability poses significant risks, as unauthorized access often occurs through an organization’s own VPN. This disguise can lead to malicious activities appearing legitimate, thereby going unnoticed until it is too late—potentially resulting in credential theft, lateral movement within networks, data theft, or the deployment of ransomware.
The recommendation from ReliaQuest for organizations still using vulnerable versions of Palo Alto products is to immediately upgrade their systems. Additionally, they advise disabling authentication override cookies where they are unnecessary, terminating all active GlobalProtect sessions post-patching, and investigating any unexpected connections. Particularly concerning are sessions established with hostnames indicative of potential threats, like "kali."
In conclusion, it is crucial to recognize that simply patching systems might not eliminate all access points established prior to remediation. Cybersecurity teams are urged to ensure comprehensive strategies are employed to safeguard against the residual threats stemming from this vulnerability. The warning from ReliaQuest serves as a critical reminder to organizations regarding the importance of cybersecurity diligence and proactive patch management in an ever-evolving threat landscape. As ransomware groups continue to leverage existing vulnerabilities, the onus lies on organizations to fortify their defenses against these persistent threats.