A PAN-OS flaw patched in May is still the front door for at least three ransomware operations, and the way they leave is a domain controller's virtual disk rather than a live server.
What happened
CVE-2026-0257 is an authentication bypass in the GlobalProtect portal and gateway of PAN-OS. An attacker who can reach the portal can skip authentication and bring up a VPN session as though they had signed in. Palo Alto Networks fixed it on 13 May 2026 and CISA added it to the KEV catalog on 29 May 2026.
In a threat brief updated on 20 October, Unit 42 said its investigations into intrusions built on this flaw started in early June. It names Qilin, Inc and Settra operators among the groups using it, and the sequence repeats: an unauthorised VPN session, reconnaissance with remote monitoring tools, then RDP and SMB movement toward servers and management systems.
The step worth studying is the pivot to virtualisation. In one case attackers went from the VPN gateway to the vCenter management appliance, turned off the execInstalledOnly control on the ESXi hosts, and pulled a domain controller's VMDK in order to extract credentials offline. Working on the disk file means endpoint protection running inside the guest never sees the theft. Unit 42 also observed tooling aimed at Veeam backup servers, including exploits for CVE-2023-27532, which exposes encrypted credentials stored in the backup configuration database.
The campaigns span organisations in education, financial services, healthcare, manufacturing, legal and professional services, government and retail, which is to say the flaw is not being aimed at one sector.
Who is affected
Any organisation running GlobalProtect on a PAN-OS release that has not been updated since May. The branch number is not enough; the hotfix suffix decides it.
- PAN-OS 12.1 before 12.1.7 or 12.1.4-h6
- PAN-OS 11.2 before 11.2.12, 11.2.10-h7, 11.2.7-h14 or 11.2.4-h17
- PAN-OS 11.1 before 11.1.15, 11.1.13-h5, 11.1.10-h25, 11.1.7-h6, 11.1.6-h32 or 11.1.4-h33
- PAN-OS 10.2 before 10.2.18-h6, 10.2.16-h7, 10.2.13-h21, 10.2.10-h36 or 10.2.7-h34
Panorama and Cloud NGFW are not affected by this vulnerability.
What to do now
Read the exact build string on every firewall and compare it with the fixed list above, not with the branch name. A device reporting 11.2.10 without the -h7 hotfix is still exposed.
- Upgrade to a fixed release for your branch and confirm the running version after the reboot.
- Take portal and management access off the public internet. Unit 42 found GlobalProtect profiles exposing management interfaces on ports 4443 and 3879.
- Hunt the VPN logs for sessions nobody can account for since June, particularly logins from hosting or VPS address ranges followed by RDP and SMB activity.
- On any firewall or vCenter appliance you cannot prove was patched on time, treat credentials and keys as stolen and rotate them.
- Check ESXi hosts for a disabled execInstalledOnly setting and check Veeam Backup and Replication for CVE-2023-27532 exposure.
What this means for South African businesses
GlobalProtect is common in South African mid-market estates, and appliances that were patched for one issue are often left a hotfix or two behind the next one. A firewall is the one device nobody reboots for housekeeping, so the gap between a May advisory and an October incident report is usually unpatched firmware rather than a missed alert.
My read is that the exposure for a local SME is less about Palo Alto than about concentration: if the same firewall, the same vCenter and the same backup server sit in one rack with one admin password store, a single bypass is a full-estate incident, and the disk-level credential theft means the clean-up after the patch is far larger than the patch itself.