Palo Alto Networks Faces Ransomware Attacks Through VPN Flaw

Reports on October 21, 2026, said multiple ransomware groups are actively exploiting a significant vulnerability in Palo Alto Networks’ GlobalProtect VPN. Tracked as CVE-2026-0257, the authentication bypass can give attackers initial access to corporate networks.

Palo Alto Networks’ Unit 42 threat intelligence team said attackers had been exploiting the flaw since as early as June. The affected organizations span sectors including healthcare and government.

Also on October 21, Evercore said its channel checks showed Palo Alto Networks and CrowdStrike had the strongest demand in AI-driven security operations. The note suggests Palo Alto Networks’ AI strategy is resonating with the market, pointing to potential future growth even as the company faces the VPN vulnerability.