On 11 October 2026, Cyber Security News reported on the exploitation of CVE-2026-0257 in the GlobalProtect feature of PAN-OS and Prisma Access from Palo Alto Networks. It is an authentication bypass that the vendor disclosed on 13 May 2026 and rated 7.8 (High). It allows an attacker without valid credentials to establish an unauthorised VPN connection.

Not every device is exposed: the flaw requires authentication override cookies to be enabled together with a specific certificate configuration. Affected are PAN-OS 12.1, 11.2, 11.1 and 10.2 and Prisma Access 11.2 and 10.2; Panorama and Cloud NGFW are not affected.

According to ReliaQuest, the Qilin and Settra ransomware groups are exploiting it, with tools such as Cobalt Strike, BloodHound and SharpHound observed. The aims are credential theft, lateral movement, data collection and ransomware deployment. ReliaQuest assesses that exploitation is highly likely to continue over the next three months.

Recommended steps: upgrade affected deployments to fixed releases (checking the vendor's table), disable authentication override cookies where not needed, generate a dedicated certificate used only for them, and upgrade every portal and gateway that issues or accepts them. After patching, terminate all active GlobalProtect sessions; users will need to sign in again. The report stresses that patching alone may not remove an attacker who got in earlier, so unexpected connections should be investigated.

What does this mean for your business?
The VPN is the door your staff use to reach company systems from outside, and exactly what attackers look for. Whether you use this product or another, know the installed version today, make sure the device is updated on a clear schedule, and that someone reviews the login logs. For small firms without a security team, the minimum is a list of everything exposed to the internet, an owner responsible for updating it, and offline backups whose restoration is tested regularly, because a clean backup decides how much you lose if a breach happens.

Source: Cyber Security News — https://cybersecuritynews.com/palo-alto-globalprotect-flaw-vpn-access