Shares in Palo Alto Networks, the Santa Clara-based cybersecurity vendor, fell 1.6% after it revealed ransomware operators have escalated exploitation of a high-severity flaw in its GlobalProtect VPN portal, according to Cybersecurity Dive.
The vulnerability, tracked as CVE-2026-0257, lets attackers bypass authentication under certain configurations and create unauthorized VPN sessions directly into a victim's network, a flaw Palo Alto Networks rated 7.8 out of 10 on the CVSS severity scale.
Palo Alto Networks issued a fix on 13 May, but Rapid7 reported active exploitation beginning around 17 May, just days later.
By June, Arctic Wolf had investigated multiple intrusions in which exploitation of the flaw led to domain-wide Qilin ransomware encryption, involving several Qilin affiliates rather than a single operator.
Exposure has stayed wide: Shadowserver tracked more than 167,000 internet-exposed GlobalProtect instances, while Shodan found over 172,000 IPs carrying a GlobalProtect fingerprint.
Unit 42, Palo Alto Networks' threat-intelligence and incident-response arm, has now linked ongoing exploitation to Qilin, also known as Spikey Scorpius, and to INC/Tarnished Scorpius, while ReliaQuest separately reported activity tied to Settra ransomware.
Researchers noted the bug can defeat normal authentication controls, including multi-factor authentication in some scenarios, making it valuable both to ransomware affiliates and to access brokers who resell network footholds to other criminals.
The flaw has become a reliable ransomware entry point roughly five months after disclosure, underscoring how unpatched internet-facing VPN appliances remain attractive targets long after vendors ship fixes.
