Ransomware Gangs Are Walking In Through Palo Alto VPNs — Even Past MFA

Ransomware groups are using a months-old flaw in Palo Alto Networks' GlobalProtect VPN to get inside business networks, and it lets them skip MFA. Palo Alto's Unit 42 team updated its threat brief on October 19 and 20: the Qilin and INC ransomware groups are exploiting CVE-2026-0257. Other researchers have also tied the Settra ransomware group to it. The flaw lets an attacker set up a VPN connection without a valid login. CISA added it to its list of actively exploited vulnerabilities back on May 13, 2026, and fixed versions are available.

Why this one matters

Your VPN is the front door for remote workers, and attackers who get in this way look like a normal remote session. According to Unit 42, once inside, attackers typically:

• explore the network using legitimate remote-management (RMM) tools,
• move between computers over RDP and Windows file sharing (SMB),
• steal passwords and data, then deploy ransomware.

In one case they jumped from the VPN to the company's virtual server management and pulled domain passwords directly from a server's disk, getting around the endpoint security software. ReliaQuest told Cybersecurity Dive the flaw "has become a reliable way into networks for ransomware groups," and expects more groups to adopt it over the next three months.

What to do this week

1. Find out what firewall and VPN you have. If it's Palo Alto with GlobalProtect turned on, this applies to you. (Palo Alto says Panorama and Cloud NGFW are not affected.)
2. Upgrade PAN-OS to a fixed release. Use the versions listed in Palo Alto's CVE-2026-0257 advisory. If you can't upgrade right away, apply the workarounds in that advisory.
3. Look for a break-in, not just the patch. Have your IT provider check GlobalProtect logs for the IP addresses and odd device names Unit 42 published (such as "GP-CLIENT" or "DESKTOP-GP01"). Look into any VPN sessions you can't explain.
4. Keep the firewall's admin page off the internet. Unit 42 found that many networks had accidentally exposed the management interface on ports 4443 and 3879. Restrict it to trusted internal addresses.
5. Limit what a VPN user can reach. Turn off RDP where you don't need it, watch for remote-access tools nobody approved, and keep backups offline or immutable so ransomware can't encrypt them too.

The bigger lesson: a patch from May still matters in October. Firewalls and VPNs need the same monthly update routine as your PCs.

Nice2GeekYou is based in San Antonio, serving all of Texas, and our managed IT plans support remote clients across the U.S. We keep firewalls and VPNs patched, review remote-access logs and lock down admin access. Request a quote, see our monthly plans, or text us at (210) 504-8969.

Sources: Palo Alto Networks Unit 42 — Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257 (updated Oct 20, 2026); Palo Alto Networks — CVE-2026-0257 security advisory; Cybersecurity Dive — Ransomware groups expand targeting of Palo Alto Networks vulnerability (Oct 20, 2026); The Hacker News — Qilin and INC ransomware groups exploit Palo Alto Networks flaw to bypass MFA (Oct 20, 2026).