Ethical Hacking News
Palo Alto Networks is facing a significant challenge as multiple ransomware groups exploit a high-severity vulnerability in its PAN-OS firewall OS. The attack allows attackers to bypass security restrictions and establish unauthorized VPN connections, posing a significant risk to organizations worldwide. To mitigate this vulnerability, organizations must patch their software immediately and implement robust cybersecurity measures to prevent similar attacks.
Palo Alto Networks' firewall OS, PAN-OS, has been under attack from multiple ransomware groups since June due to a high-severity authentication bypass bug. The vulnerability, CVE-2026-0257, was initially rated as medium-severity but was later found to be exploitable across multiple customer environments. Ransomware groups, including Qilin and Inc, are using the vulnerability to gain an initial foothold into corporate networks and move laterally using Remote Desktop Protocol and Server Message Block. The attackers are bypassing multi-factor authentication controls to establish a VPN session, allowing them to steal domain-wide credentials. Palo Alto Networks has advised organizations to patch their vulnerable PAN-OS software immediately and provided indicators of compromise to assist with threat-hunting activities.
Palo Alto Networks, a leading provider of cybersecurity solutions, has been facing a significant challenge in recent months. Since June, the company's firewall OS, PAN-OS, has been under attack from multiple ransomware groups. This attack vector is particularly concerning, as it exploits a high-severity authentication bypass bug in PAN-OS, which allows attackers to bypass security restrictions and establish an unauthorized VPN connection.
The vulnerability, identified as CVE-2026-0257, was first disclosed and patched by Palo Alto Networks on May 13. However, the company initially assigned a medium-severity rating to the bug, indicating that it was aware of attempts to exploit it but had not observed any malicious exploitation. This assessment quickly changed, and by the end of the month, Rapid7 researchers observed successful exploitation of the vulnerability across multiple customer environments, dating back to at least May 17.
Since then, multiple ransomware groups, including Qilin and Inc, have been leveraging this vulnerability to gain an initial foothold into corporate networks. Once inside, the attackers move laterally across the networks using Remote Desktop Protocol and Server Message Block (SMB), dropping additional malware for credential harvesting and data theft before ultimately deploying ransomware. According to Andy Piazza, a senior director of threat intelligence at Unit 42, the attackers are using this vulnerability to gain an initial foothold into corporate networks, subsequently bypassing multi-factor authentication (MFA) controls to establish a VPN session.
In its ongoing investigations, Unit 42 has spotted the ransomware criminals infecting numerous industries, including education, financial services, healthcare, high tech, hospitality, manufacturing, professional and legal services, government, transportation and logistics, utilities and energy, and wholesale and retail. The attackers are also chaining this exploit for initial access with other vulnerabilities, such as CVE-2023-27532, which targets Veeam backup infrastructure.
The impact of this vulnerability is significant, as it allows attackers to bypass in-guest endpoint detection and response products, and represents a highly sophisticated method of stealing domain-wide credentials. Piazza warned that the most significant evolution in tactics, techniques, and procedures (TTPs) following successful exploitation of CVE-2026-0257 is the direct pivot to the virtualization layer.
To mitigate this vulnerability, Palo Alto Networks has advised organizations to patch their vulnerable PAN-OS software immediately. Unit 42 has also provided indicators of compromise to assist with threat-hunting activities. It is essential for organizations to take immediate action to protect themselves from this critical vulnerability and to implement robust cybersecurity measures to prevent similar attacks in the future.
Related Information:
https://www.ethicalhackingnews.com/articles/Palo-Alto-Networks-Under-Siege-Multiple-Ransomware-Groups-Exploit-Critical-Vulnerability-in-PAN-OS-ehn.shtml
https://www.theregister.com/cyber-crime/2026/10/20/palo-altos-firewall-os-has-been-under-attack-from-multiple-ransomware-groups-since-june/5304226
https://hackerfeeds.com/news/palo-alto-s-firewall-os-been-under-attack-from-ransomware-groups-9jeojs
https://nvd.nist.gov/vuln/detail/CVE-2026-0257
https://www.cvedetails.com/cve/CVE-2026-0257/
https://nvd.nist.gov/vuln/detail/CVE-2023-27532
https://www.cvedetails.com/cve/CVE-2023-27532/
Published: Tue Oct 20 20:12:34 2026 by llama3.2 3B Q4_K_M
