"Attackers are leveraging this vulnerability to gain an initial foothold into corporate networks, subsequently bypassing multi-factor authentication (MFA) controls to establish a VPN session," Andy Piazza, senior director of threat intelligence at Unit 42, warned.
CVE-2026-0257 and the disclosure timeline
The flaw tracked as CVE-2026-0257 affects Palo Alto Networks' PAN-OS GlobalProtect portals and gateways and can allow an attacker to bypass authentication restrictions and establish an unauthorized VPN connection. Palo Alto Networks disclosed and patched the bug on May 13 and initially assigned it a medium-severity rating, saying at that time it was aware of attempts to exploit the issue but had not observed malicious exploitation. That assessment changed quickly: Rapid7 researchers said they observed successful exploitation across multiple customer environments dating back to at least May 17, and Unit 42 has been investigating attacks since early June.
How criminals are using the authentication bypass
Unit 42 says attackers use CVE-2026-0257 to gain initial access, then bypass multi-factor authentication by establishing an unauthorized VPN session. Once inside, criminals move laterally using Remote Desktop Protocol (RDP) and Server Message Block (SMB), drop additional malware to harvest credentials and steal data, and ultimately deploy ransomware. Unit 42 described this pattern as an initial foothold through the VPN gateway followed by credential harvesting and data theft prior to ransomware deployment.
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coveragePivoting to virtualization and offline credential theft
Investigators described a notable escalation in technique after successful exploitation: attackers are pivoting directly to the virtualization layer. In one case Unit 42 observed, operators moved from the compromised VPN gateway to a vCenter management appliance, disabled a security control on ESXi hypervisors (execInstalledOnly), and used a custom tool to perform offline credential dumping directly against a domain controller's virtual disk (VMDK). According to Unit 42, this method allows adversaries to bypass in‑guest endpoint detection and response products and represents "a highly sophisticated method" of stealing domain‑wide credentials.
Ransomware groups, collision with other vulnerabilities, and affected sectors
Unit 42 reported that multiple ransomware crews, including Qilin and Inc, continue to exploit CVE-2026-0257. ReliaQuest intelligence analysts also warned that "multiple threat groups," including Settra ransomware operators, are using the vulnerability to gain unauthorized VPN access. Unit 42's investigations have spotted infections across a wide range of sectors: education; financial services; healthcare; high tech; hospitality; manufacturing; professional and legal services; government; transportation and logistics; utilities and energy; and wholesale and retail.
Unit 42 has also observed criminals chaining the PAN-OS exploit with other flaws, such as CVE-2023-27532, which targets Veeam backup infrastructure — a combination that expands the attackers' ability to compromise backup systems after an initial VPN gateway breach. Palo Alto Networks did not respond to The Register's inquiries about the attacks, including how many organizations have been infected.
What this means for technologists, procurement leaders, and affected enterprises
- Technologists and security teams: Patch vulnerable PAN-OS installations immediately; Unit 42 specifically urges operators who haven't yet patched to do so and to investigate whether attackers have already gained access. Unit 42 also published indicators of compromise to assist threat-hunting activities.
- Procurement and vendor-risk teams: Note that Palo Alto initially rated the flaw as medium severity but the operational picture changed within weeks; teams should confirm that vendor patches are applied promptly and track how vendor severity assessments evolve following disclosure.
- Affected enterprises (IT operations, incident response): Prioritize searches for signs of unauthorized VPN sessions, lateral movement via RDP/SMB, and evidence of virtualization-layer tampering (vCenter access, ESXi control changes, VMDK access). Given Unit 42's observations of chaining to Veeam-targeting CVE-2023-27532, review backup infrastructure for indicators of compromise as well.
Two clear facts remain: adversaries have weaponized CVE-2026-0257 in the wild, and investigators are seeing increasingly sophisticated post‑exploit behavior that targets virtualization management and backup systems. Palo Alto's silence to The Register on infection counts leaves an important operational question open for defenders: how widespread are successful intrusions?
For defenders the immediate steps are explicit in Unit 42's advisory: apply the May 13 PAN-OS patch if you have not already, hunt using Unit 42's indicators of compromise, and investigate whether an unauthorized VPN session provided an adversary with an initial foothold.
