https://reddit.com/r/sysadmin/comments/1xb50d0/panos_patched_in_may_still_a_ransomware_favorite/: PAN-OS patched in May. Still a ransomware favorite in October.
Published Oct 20, 2026
·Updated
Affected Software
1 affected component
Palo Alto Networks PAN-OS
Frequently Asked Questions
1
Does enforcing MFA on GlobalProtect prevent exploitation?
No. The vulnerability allows attackers to bypass GlobalProtect authentication and establish VPN sessions without MFA.
2
Why might endpoint detection on domain controllers not reveal credential theft in this scenario?
Attackers can obtain domain controller credentials from the virtual disk (VMDK) rather than interacting with the running Windows guest. EDR deployed inside that guest would not observe this form of credential dumping.
3
What infrastructure should be investigated after suspected VPN compromise?
Review access to VMware vCenter and ESXi hosts. The reported activity included moving from the VPN to vCenter, disabling ESXi security controls, and accessing a domain controller's VMDK.
4
Is a patch available?
Yes. A patch was available in May 2026, and exploitation by ransomware groups was reported from June onward.