Ransomware groups Qilin, Inc and Settra actors exploit PAN-OS GlobalProtect auth bypass CVE-2026-0257, pivoting to vCenter/ESXi
Palo Alto Networks Unit 42 reports active exploitation of CVE-2026-0257, an authentication bypass in the portal and gateway components of PAN-OS GlobalProtect. The flaw lets unauthorized attackers circumvent security controls and open VPN connections. The October 19 update says Unit 42 continues to see exploitation attempts by ransomware …