Source: Palo Alto Networks Unit 42
Unit 42 has published an updated threat brief on CVE-2026-0257, an authentication bypass affecting the GlobalProtect portal and gateway in vulnerable PAN-OS versions. The flaw, which has been on CISA’s Known Exploited Vulnerabilities catalog since 13 May 2026, lets an unauthenticated attacker establish a VPN session and bypass multi-factor authentication controls. In its 19 October update, Unit 42 confirms that ransomware operators including Qilin and Inc Ransom are using it for initial access, with public reporting also attributing exploitation to actors deploying Settra ransomware.
Following a successful foothold, the attackers typically run internal reconnaissance with dual-use remote monitoring and management tools, move laterally over RDP and SMB, stage credential harvesting, and finally deploy ransomware. The investigations span numerous industries, including manufacturing, healthcare, financial services, government and transportation.
The new move: straight to the virtualization layer
The most significant evolution in tactics is a direct pivot from the compromised VPN gateway to the virtualization layer. In one documented case, attackers reached the vCenter management appliance, disabled security controls on ESXi hypervisors and used a custom tool to perform offline credential dumping directly against a domain controller’s virtual disk. Because the credential theft happens against the VMDK rather than inside the guest, in-guest endpoint detection and response tools see nothing. Unit 42 has also observed the actors chaining this initial access with exploitation of Veeam backup infrastructure, CVE-2023-27532, to maximise impact.
For European organisations, the message is blunt. An unpatched GlobalProtect portal is not just a VPN risk, it is a path to domain-wide credentials that endpoint security cannot see. Patching the gateway, segmenting management networks such as vCenter from user-facing infrastructure, and locking down backup platforms are no longer optional hardening steps.
If your organisation runs PAN-OS firewalls, VMware infrastructure or Veeam backup and you want a pragmatic assessment of your exposure to exactly this attack path, contact Excello Digital at https://excello.digital/contact/. We help European businesses prioritise the fixes that actually block ransomware, not just the ones that look good on a report.