High Known exploited Patch available
Ransomware groups exploit Palo Alto GlobalProtect VPN flaw since June
Help Net SecurityPalo Alto Networks, PAN-OS, GlobalProtect · healthcare, education, governmentCVE-2026-0257
What happened. Several ransomware groups are exploiting CVE-2026-0257, an authentication bypass in PAN-OS GlobalProtect patched in May. Cookies are not properly validated, so remote, unauthenticated attackers can set up an unauthorised VPN connection.
Who is affected. Palo Alto Networks PAN-OS GlobalProtect portals and gateways; named victim sectors include healthcare, education, government and energy.
What to do. Apply the May fix for CVE-2026-0257 on PAN-OS GlobalProtect portals and gateways, and check for unauthorised VPN connections since June.
Editor's reading
Forasset ownerOT security leadIT security
- Purdue level
- L5
Why: GlobalProtect is an internet-facing VPN portal and gateway on the firewall, so it sits at the enterprise edge and gives a way into internal networks.
- Are you exposed?
Check whether PAN-OS firewalls with a GlobalProtect portal or gateway enabled have the May fix, and review VPN logs since June for unexplained connections.
- If you cannot fix it yet
- Limit access to the GlobalProtect portal and gateway to known source addresses where possible.
- Require multi-factor authentication and a jump host for any VPN route into OT networks.
- Watch for
- VPN sessions established without a matching user login event, particularly since June.
- Logons to L2 or L3 hosts from the VPN address pool shortly after new GlobalProtect sessions.
- ATT&CK for ICS
- T0822External Remote Services
Inferred from the facts above, not stated by the source. Check it against your own site before acting.
Source: Help Net Security (opens helpnetsecurity.com)
More on Palo Alto Networks Healthcare Government CVE-2026-0257