Search: CVE-2026-0257

Authentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS® software allows the attacker to bypass security restrictions and establish an unauthorized VPN connection. Panorama and Cloud NGFW are not impacted by these issues.

The threat actor k0t is conducting a large-scale campaign targeting network edge devices from FortiGate, FortiWeb, and Palo Alto GlobalProtect. The campaign exploits known vulnerabilities CVE-2025-64446 and CVE-2026-0257, combined with brute-force attacks, to harvest over 70,000 credentials globally. Post-compromise activities include credential theft, Active Directory enumeration, and data exfiltration using Rclone to cloud storage. Persistence is maintained through tools such as MeshCentral, AdaptixC2, and remote management software like Atera and AnyDesk. The campaign overlaps with ransomware groups Qilin and The Gentlemen, suggesting k0t may act as an Initial Access Broker, though no direct affiliation is confirmed.