What happened
Organisations running Palo Alto Networks PAN-OS or Prisma Access have been targeted by ransomware groups exploiting a security vulnerability, identified as CVE-2026-0257. Despite the flaw being patched in May 2026, threat actors continue to exploit systems that have not yet applied updates. The vulnerability is an authentication bypass that enables attackers to set up unauthorised VPN connections, circumventing multi-factor authentication (MFA). The exploitation involves leveraging the flaw to establish initial access via the VPN, without requiring MFA verification. This initial compromise can facilitate further malicious activities, including deployment of ransomware. The activity, which is believed to be linked with known ransomware groups, presents a substantial security threat to affected deployments. Who is affected Any organisation operating unaffected versions of Palo Alto Networks PAN-OS or Prisma Access remains vulnerable to this ongoing exploitation activity. Those that have not yet applied the security patch introduced in May 2026 are at increased risk of compromise. The vulnerability's high severity (CVSS score: 7.8) underscores the importance of verifying that systems are up-to-date and monitoring for suspicious activity related to unauthorised VPN connections. Recommended actions
Ensure that impacted systems are updated with the latest security patches provided by Palo Alto Networks, specifically addressing CVE-2026-0257. Implement monitoring for unauthorised VPN connection attempts, especially those that may bypass MFA controls, to detect potential exploitation activity. Review VPN access logs for indications of unauthorised or anomalous connection attempts.
