Ransomware · Vulnerabilities
Ransomware Groups Still Targeting Old Palo Alto VPN Flaw, Experts Warn
A serious vulnerability in Palo Alto Networks VPNs, patched in May, is still being exploited by ransomware groups. Some systems remain unpatched, putting organisations at risk.
Ross Grant3 min read
The short version
A serious security flaw in Palo Alto Networks VPN products was fixed in May, but some organisations have not updated their systems. Ransomware groups are using this flaw to break into networks and launch attacks. If you use these products, check for updates and apply them as soon as possible.
What happened?
Ransomware groups, including Qilin and Settra, are actively exploiting a serious vulnerability (CVE-2026-0257) in Palo Alto Networks VPN products. The flaw was patched in May 2026, but some systems remain unpatched. Multiple security teams have reported ongoing attacks.
The Vulnerability and Its Impact
A high-severity flaw in Palo Alto Networks VPN products, first patched in May 2026, is still being targeted by ransomware groups. The vulnerability, tracked as CVE-2026-0257, allows attackers to bypass authentication and gain unauthorised access to internal networks. This means that if a system is not updated, attackers can get in without needing a password or other credentials. The flaw affects several versions of PAN-OS (the operating system for Palo Alto firewalls) and Prisma Access, a cloud-based security platform.
The vulnerability was discovered by Palo Alto Networks and publicly disclosed on 13 May 2026. The company gave it a "highest" urgency rating and a CVSS score of 7.8, which measures how severe a security flaw is. The US National Vulnerability Database later rated it even higher, at 9.1 (critical). Fixed versions were released, and customers were urged to update as soon as possible. The US Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its Known Exploited Vulnerabilities (KEV) list on 29 May, requiring US federal agencies to patch by 1 June.
Who Is Exploiting the Flaw?
According to ReliaQuest, ransomware groups including Qilin and Settra are actively exploiting CVE-2026-0257. These groups use the vulnerability to establish unauthorised VPN sessions, which can give them a foothold inside a target's network. Once inside, they can deploy ransomware or steal sensitive data. Multiple threat intelligence teams have reported ongoing exploitation attempts, including Rapid7 in May, Palo Alto’s Unit 42 in June, and Arctic Wolf in July. This shows that attackers are still finding unpatched devices months after the fix was released.Infosecurity Magazine (opens in a new tab)
Why Are Systems Still Unpatched?
Despite strong warnings from vendors and government agencies, some organisations have not yet applied the patch. Reasons can include lack of awareness, resource constraints, or concerns about downtime during updates. Attackers often scan the internet for vulnerable systems, knowing that some will remain unpatched long after a fix is available. This is a common pattern in cyber security: old vulnerabilities continue to be exploited because not everyone updates promptly.
What Should Organisations Do?
If your organisation uses Palo Alto Networks VPN products, check which version you are running. If you have not applied the patch for CVE-2026-0257, do so immediately. Review your systems for signs of unauthorised access, especially if you have delayed patching. It is also good practice to monitor for unusual VPN connections and to review logs for suspicious activity. Regular patch management is essential to reduce the risk of ransomware and other attacks.
Ongoing Risks and Lessons
This incident highlights the importance of quick patching and monitoring. Even high-profile vulnerabilities can remain a threat for months if systems are not updated. Attackers are persistent and will continue to target known flaws as long as they find unprotected systems. Security teams should prioritise patching for vulnerabilities listed in the CISA KEV catalogue and follow up with monitoring and incident response plans.
Uncertainties
At this stage, the only public reporting comes from Infosecurity Magazine, citing ReliaQuest advisories. There is no direct confirmation from Palo Alto Networks or government agencies in the sources available. The full scale of exploitation and the number of affected organisations are not yet clear.
Claimed vs confirmed
- Confirmed
ReliaQuest confirmed Qilin and Settra ransomware groups are exploiting CVE-2026-0257.
ReliaQuest advisories, as reported by Infosecurity Magazine, state that these groups are actively exploiting the vulnerability.
- Confirmed
Multiple threat intelligence teams have reported exploitation attempts in recent months.
Rapid7, Palo Alto’s Unit 42, and Arctic Wolf have all reported attempted exploitation since May, according to Infosecurity Magazine.
The impact
- Money
- If regulators find that an organisation failed to patch a known critical vulnerability, fines can be significant. Under UK GDPR, fines can reach up to £17.5 million or 4% of global turnover.
- Reputation
- Being compromised by a known and patched flaw can damage trust and raise questions about an organisation's security practices.
- Customers
- Customers of affected organisations could face data theft or service disruption if attackers gain access through this vulnerability. Organisations should notify affected users if a breach occurs.
Why it matters
Organisations that use Palo Alto Networks VPNs and have not patched are at risk of ransomware attacks. Attackers can use the flaw to get inside networks, potentially leading to data theft or business disruption.
How does it work?
CVE-2026-0257 is an authentication bypass vulnerability. Attackers can use it to establish unauthorised VPN sessions, giving them access to internal networks without needing valid credentials.
Key points
- A critical Palo Alto VPN flaw is still being exploited months after a patch was released.
- Ransomware groups are using the vulnerability to gain access to internal networks.
- Some organisations have not yet applied the fix, leaving them exposed.
- Security teams should patch immediately and monitor for suspicious VPN activity.
- Ongoing exploitation highlights the need for strong patch management.
Sources
Infosecurity Magazine
Reference
- Months-Old Palo Alto VPN Vulnerability Remains a Target for Ransomware Groups (opens in a new tab)
infosecurity-magazine.com
- Months-Old Palo Alto VPN Vulnerability Remains a Target for Ransomware Groups (opens in a new tab)
