Ransomware Operators Actively Exploiting Palo Alto Networks GlobalProtect VPN Authentication Bypass Vulnerability

Ransomware groups are leveraging CVE-2026-0257, an authentication bypass vulnerability in Palo Alto Networks PAN-OS GlobalProtect and Prisma Access, to establish unauthorized VPN sessions and infiltrate internal networks. This flaw allows attackers to mimic legitimate remote work, potentially delaying detection.