Ransomware Crews Exploit PAN-OS GlobalProtect Flaw to Breach VPNs

En bref

• CVE-2026-0257 affects PAN-OS GlobalProtect portal and gateway components.
• Attackers skip login checks and establish VPN connections, then move into internal networks.
• Ransomware groups are among those abusing the flaw, with activity seen since June.
• Healthcare, education, government, and energy organizations are in scope.
• Palo Alto Networks released a patch in May; reporting is current to October 21, 2026.

Palo Alto Networks has disclosed a high-severity weakness in PAN-OS, identified as CVE-2026-0257, that sits in the GlobalProtect portal and gateway components. The defect allows an attacker to get past authentication and bring up a VPN connection without legitimate credentials. A fix was published in May, yet abuse has been observed from June onward, and the reporting timeline runs through October 21, 2026.

Ransomware operators are among the threat actors taking advantage. By skipping the login step and creating a VPN session, they gain a foothold that can be used to push deeper into a victim's network. That pattern turns an internet-facing VPN service into an entry point for broader intrusion and, eventually, extortion-driven ransomware activity.

Organizations in healthcare, education, government, and energy are exposed, along with other sectors. For K-12 and higher education, where remote access is often concentrated on a single VPN portal, a bypass can expose student, staff, and administrative systems. The same risk applies to any agency or utility that relies on GlobalProtect for remote work.

Edge VPN appliances are trusted gateways, so a flaw that removes the authentication check undermines a core perimeter control. The May patch exists, but unpatched or overlooked deployments remain reachable. Ransomware crews favor quiet initial access, and a valid-looking VPN session can blend into normal remote-work traffic.

Administrators should inventory PAN-OS GlobalProtect portals and gateways, confirm patch status, and review VPN logs from June through October 21, 2026 for anomalous sessions. Watch for logins from unexpected locations, new device profiles, and follow-on lateral movement. Treat any suspicious session as a potential intrusion and escalate.

À faire maintenant

1. Patch PAN-OS GlobalProtect portal and gateway instances to the vendor-fixed release; verify the update on every node, including HA pairs.
2. Inventory internet-facing GlobalProtect services and confirm which are still exposed; remove unnecessary external access.
3. Review VPN authentication and connection logs from June through October 21, 2026 for sessions that bypassed normal login or came from unusual sources.
4. Terminate suspicious VPN sessions, rotate credentials for affected accounts, and check for unauthorized configuration changes.
5. If patching cannot happen immediately, restrict GlobalProtect access to trusted networks or disable the service until the fix is applied.
6. Hunt for ransomware precursor activity on systems reached through VPN, including new accounts, remote tooling, and lateral movement.
7. Subscribe to Palo Alto Networks advisories and apply future PAN-OS security updates promptly.

Références CVE

• CVE-2026-0257

Source originale

Help Net Security