What happened
- Unit 42, from Palo Alto Networks, published on October 20, 2026 its alert on active exploitation of CVE-2026-0257, an authentication bypass in the portal and gateway components of GlobalProtect, PAN-OS’s VPN service.
- By October 19, ransomware operators were attempting to exploit it, among them Qilin (Spikey Scorpius) and Inc (Tarnished Scorpius). Public reports add Settra.
- Attackers bypass the second factor to open VPN sessions, run reconnaissance with remote administration tools and move through RDP and SMB.
- In one case they pivoted from the gateway to the vCenter appliance, disabled ESXi’s execInstalledOnly control and extracted credentials from a domain controller’s virtual disk.
Why it matters
- The second factor is the defense most trusted on a VPN. If the flaw sidesteps it, a leaked password stops being the only problem: access opens without raising an alert.
- For Chilean banks, clinics and municipalities using GlobalProtect, the immediate question is the installed version and whether the patch is applied. The alert lists no affected versions and refers to the vendor’s advisory.
- The flaw has been in the exploited-vulnerabilities catalog of the US cybersecurity body, CISA, since May 13, so whoever has not patched has been exposed for five months.
The number
May 13, 2026: the date CVE-2026-0257 entered the KEV catalog of exploited vulnerabilities, five months before the alert.
Context
This is not the month’s first critical flaw: PHP announced two flaws with a patch on a Wednesday and SGLang exposed remote code execution without a key. What is particular here is that the exploitation comes from already known ransomware groups and that the alert recommends upgrading to a fixed version. Unit 42 has investigated cases since June in health, finance, government and energy.
What’s next
- Unit 42’s alert carries verification and remediation guidance added on October 20.
- Palo Alto Networks’ advisory is the source for fixed versions and mitigations.
- No public count of compromised organizations: the alert does not give one.
Bottom line
A flaw in the KEV catalog since May and active ransomware in October describe both the flaw and patch management. For many organizations, the date of application is the figure that is never published.
Sources
- Unit 42 — Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257 — published and updated October 20, 2026
- Image: ProjectManhattan, CC BY-SA 3.0, via Wikimedia Commons
Edited by Rodrigo Cornejo. How we select and verify: who writes these notes.
