Two ransomware operations are using an authentication bypass Palo Alto Networks patched six months ago to walk into hospital VPNs, and the vendor says exploitation is still underway.
The flaw is CVE-2026-0257, a 7.8-severity weakness in the GlobalProtect portal and gateway of PAN-OS. Palo Alto's advisory rates exploit maturity as "attacked," published the fix May 13, and updated guidance June 3. An unauthorized VPN connection is all an intruder needs; no credential is required and no user clicks anything.
Palo Alto's Unit 42 ties the activity to groups it tracks as Spikey Scorpius and Tarnished Scorpius, better known as Qilin and INC. Separate reporting links the flaw to Settra. Qilin has repeatedly listed U.S. hospitals and clinics, including a Honolulu dental group in September. INC claimed the 2024 Ahold Delhaize intrusion that exposed health information on 2.2 million people.
Why hospital VPNs are the soft target
Remote access appliances are how clinicians reach imaging, scheduling, and records systems from home and satellite clinics. A bypass that manufactures a valid tunnel puts an intruder inside with the same view a physician has.
The patch gap is the story
Exposure is conditional, which is what makes it easy to miss. Palo Alto says GlobalProtect is only affected when authentication override cookies are enabled and a specific certificate configuration exists. Versions below 12.1.4-h6 and 12.1.7 are vulnerable, along with older 11.2, 11.1, and 10.2 branches. Prisma Access is being upgraded for customers on a vendor schedule.
Treat this as an identity problem, not a firewall ticket. Hunt for VPN sessions that authenticated without a matching MFA success event from the same user and source.
Then confirm the version and the cookie setting on every edge device, including those managed by a vendor whose change window you do not control.
