Palo Alto PAN-OS CVE-2026-0257 Exploited by Ransomware

Ransomware is using the Palo Alto PAN-OS GlobalProtect bypass right now

The lead item today is CVE-2026-0257, a critical authentication bypass in Palo Alto Networks PAN-OS. It is on the CISA KEV list, it is ransomware-linked, and Cyber Security News reports active abuse through GlobalProtect for stealthy VPN access. CVSS is 9.1 and EPSS sits at 0.9689, so both the severity and the probability of exploitation are high.

The attack pattern matters. Getting in through the VPN front door gives an operator a quiet foothold that looks like normal remote access, which is exactly what ransomware crews want before they move laterally. This is a patch-now item, not a patch-eventually item. If you run PAN-OS with GlobalProtect exposed to the internet, treat remediation as the top job for the day and review VPN logs for unexpected authentications.

The KEV hot list: TeamCity, cPanel, Struts, and ProFTPD

No new KEV additions came through since October 10, but several already-listed CVEs stay dangerous and are worth confirming against your own inventory. Three of the top movers are ransomware-linked in addition to being KEV-listed.

The common thread is reachable services that lead straight to code execution or account takeover. Deserialization and path traversal in build servers, missing authentication in hosting panels, and command injection in old Struts are all reliable intrusion routes. Confirm patch state on anything internet-facing.

• CVE-2026-63077, JetBrains TeamCity deserialization, Critical, CVSS 9.8, KEV, ransomware-linked
• CVE-2024-27199, JetBrains TeamCity path traversal, High, CVSS 7.3, EPSS 0.9999, KEV, ransomware-linked
• CVE-2026-41940, WebPros cPanel and WHM missing authentication, Critical, CVSS 9.8, KEV, ransomware-linked
• CVE-2016-3081, Apache Struts command injection, High, CVSS 8.1, KEV
• CVE-2015-3306, ProFTPD improper access control, Critical, CVSS 10, EPSS 0.995, KEV
• CVE-2015-5477, ISC BIND data processing error, High, CVSS 7.5, KEV

Patch Tuesday and what the press adds

Help Net Security's October 2026 Patch Tuesday forecast flags an Office cleanup theme and names CVE-2026-85880 and CVE-2026-81963 to watch. The Windows cumulative updates this cycle are heavy: KB5046616 for Windows Server 2022 covers 34 CVEs, KB5046617 for Windows 11 24H2 on ARM64 covers 33, and KB5046615 for Windows 10 1809 covers 28, all rated Critical and all flagged with KEV-relevant content.

Outside Microsoft, Citrix is urging immediate patching of a critical NetScaler ADC and Gateway RCE, CVE-2026-107406, per both Cyber Security News and SecurityWeek. SecurityWeek also reports unpatched AhsayCBS flaws, CVE-2026-105133 and CVE-2026-105134, being exploited in the wild. A PoC is out for a Telegram Desktop one-click takeover flaw, CVE-2026-107181, and Help Net Security covers an NVIDIA DCGM Exporter issue, CVE-2026-47483, that lets unauthenticated attackers crash GPU monitoring. On the mail side, Microsoft Teams is adding warnings for malicious links hidden in QR codes, which is useful context for your phishing defenses.

Do this first

Work in order of exploitation evidence, not just CVSS.

• Patch or mitigate PAN-OS CVE-2026-0257 on any GlobalProtect gateway, then audit VPN authentication logs.
• Confirm TeamCity (CVE-2026-63077, CVE-2024-27199) and cPanel/WHM (CVE-2026-41940) are patched; all three are KEV and ransomware-linked.
• Deploy this month's Windows cumulative updates (KB5046616, KB5046617, KB5046615, KB5046612) and prioritize the Office items in the forecast.
• Patch Citrix NetScaler CVE-2026-107406 and check AhsayCBS for CVE-2026-105133 and CVE-2026-105134.
• Use Senserva's free Microsoft Patch Tracker to rank your open Microsoft patches by KEV, EPSS, and ransomware linkage, and the non-Microsoft exploited-CVE tracker to follow KEV additions as they land.

Sources

• Cyber Security News: Ransomware Actors Exploiting Palo Alto GlobalProtect Flaw for Stealthy VPN Access (2026-10-11)
• Help Net Security: Week in review: FortiBleed is still active, Patch Tuesday forecast (2026-10-11)
• Cyber Security News: Citrix Urges NetScaler ADC and Gateway Customers to Patch for New Critical RCE Vulnerability (2026-10-09)
• SecurityWeek: Citrix Urges Immediate Patching of Critical NetScaler Vulnerability (2026-10-09)
• SecurityWeek: Unpatched AhsayCBS Vulnerabilities Exploited in the Wild (2026-10-09)
• Help Net Security: October 2026 Patch Tuesday forecast: Time for an Office cleanup (2026-10-09)
• Cyber Security News: PoC Released for Telegram Desktop Flaw Enabling One-Click File Account Takeover (2026-10-09)
• Help Net Security: High-severity NVIDIA vulnerability lets unauthenticated attackers crash GPU monitoring (2026-10-09)
• Cyber Security News: Microsoft Teams to Warn Users About Malicious Links Hidden in QR Codes (2026-10-10)

Written by Senserva Trustworthy AI from the day's live partner feeds (CISA KEV, MSRC, FIRST EPSS, and the trusted press list), validated so every CVE, KB, and reference resolves to that data. The sources behind every feed, and their terms, are on our Data sources & thanks page. Facts as of 2026-10-12.

Senserva is a Microsoft security company and a member of the Microsoft Intelligent Security Association. Senserva audits your Microsoft 365, Intune, Defender, and Entra ID environment: complete patch state, 650+ security checks, and full reports, with clear guidance on what to fix first.