Palo Alto Networks Warns of Ransomware Attacks Through Critical VPN Flaw

Palo Alto Networks is warning that attackers are actively exploiting CVE-2026-0257, a critical vulnerability in its PAN-OS software. The flaw bypasses authentication in the GlobalProtect portal and gateway, potentially allowing an unauthenticated attacker to establish an unauthorized VPN connection.

The company's Unit 42 threat intelligence team has observed ransomware operators exploiting the vulnerability, including Spikey Scorpius, also known as Qilin, and Tarnished Scorpius, also known as Inc. Security researchers have described how attackers use the access to move laterally within networks, steal data and deploy Qilin ransomware.

Palo Alto Networks has issued patches and is urging customers to apply updates or mitigation measures immediately.