Ransomware groups are actively exploiting a flaw in Palo Alto Networks GlobalProtect VPN (CVE-2026-0257) to log in without proper authorisation and move into business networks. Security researchers report attacks are continuing months after the patch was released.

• What it is: An authentication bypass in the GlobalProtect portal and gateway on PAN-OS and Prisma Access.
• Who is affected: Businesses running GlobalProtect with authentication override cookies enabled. Panorama and Cloud NGFW are not affected.
• The risk: Attackers can open unauthorised VPN sessions and reach internal systems, where ransomware groups such as Qilin and Settra have been observed.
• What to do: Upgrade to a fixed release listed in the vendor advisory, disable authentication override cookies if they are not needed, and end all active GlobalProtect sessions after patching.
• Check for compromise: Review VPN logs for unexpected connections, and compare them with the indicators published by the researchers.

We recommend businesses using Palo Alto firewalls check their GlobalProtect settings today. If you would like help reviewing your firewall or VPN logs, contact the OzComm team.

Sources: GBHackers, citing ReliaQuest research.