Ransomware actors exploit Palo Alto GlobalProtect bypass CVE-2026-0257, ReliaQuest reports
ReliaQuest reports ransomware actors are exploiting CVE-2026-0257, an authentication bypass in Palo Alto PAN-OS GlobalProtect and Prisma Access. The Bedrock Agents credential flaw Zenity found is already fixed.
The Watch · Security desk
GlobalProtect, Prisma Access: ransomware actors exploit CVE-2026-0257, an authentication bypass, per ReliaQuest. SANS: patch gateways, update clients. Bedrock AI agents: a now-fixed SSRF could reveal IMDS credentials via IMDSv1 and overly broad permissions. SANS: limit agent URLs, use IMDSv2.
- exposure GlobalProtect, Prisma Access Ransomware actors exploit CVE-2026-0257, an authentication bypass in PAN-OS, per ReliaQuest, claim 1
- decision VPN gateways and clients SANS advises patching VPN gateways and keeping VPN clients updated too, claim 5
- exposure Amazon Bedrock AI agents Now-fixed SSRF found by Zenity Labs: a prompt could make an agent reveal IMDS credentials, claim 6
- constraint Bedrock agent setups IMDSv1 and overly broad permissions made the credential exposure possible, per Zenity Labs, claim 7
- decision AI agent operators SANS advises restricting the URLs AI agents can reach and always using IMDSv2, claim 8
| Who | How | Kind | Claim |
|---|---|---|---|
| GlobalProtect, Prisma Access | Ransomware actors exploit CVE-2026-0257, an authentication bypass in PAN-OS, per ReliaQuest | exposure | 1 |
| VPN gateways and clients | SANS advises patching VPN gateways and keeping VPN clients updated too | decision | 5 |
| Amazon Bedrock AI agents | Now-fixed SSRF found by Zenity Labs: a prompt could make an agent reveal IMDS credentials | exposure | 6 |
| Bedrock agent setups | IMDSv1 and overly broad permissions made the credential exposure possible, per Zenity Labs | constraint | 7 |
| AI agent operators | SANS advises restricting the URLs AI agents can reach and always using IMDSv2 | decision | 8 |
What happened
- ReliaQuest says the attackers use the bypass to open unauthorized VPN sessions.
- Zenity Labs found a now-fixed server-side request forgery in Amazon Bedrock AI agents, where a prompt could make an agent fetch and reveal credentials from the EC2 metadata service.
- SANS covered both items in its Stormcast of Monday, October 12, 2026.
Why it matters
- exposure Any internet-facing GlobalProtect or Prisma Access deployment that has not taken the fix is open to attackers already using the bypass, per ReliaQuest.
- decision Gateway owners patch first, and SANS adds that VPN clients need updating as well as the gateways.
- decision For agents an operator runs, SANS says to restrict the URLs they can reach and use IMDSv2, a configuration review with no reported attacks behind it.
The exploitation claim comes from one place in the SANS notes, a ReliaQuest post on X [3]. Palo Alto Networks' own advisory for the CVE is linked beside it [4]. The summary does not say which ransomware groups are involved, which releases carry the fix, when exploitation began, or whether anyone has used the Bedrock flaw against a customer. Because the report describes exploitation in progress, we'd treat any internet-facing GlobalProtect or Prisma Access deployment that has not taken the fix as reachable by these actors today.
The Bedrock side is a different kind of item. Johannes Ullrich of the Internet Storm Center said, "AI agents often have the ability to reach out to other websites in order to retrieve information" [9]. He called that the typical pattern that can be used for server-side request forgery [10].
Amazon's fix closes the path Zenity found [6]. In our view it does not touch an agent an operator builds with its own fetch tool, and SANS says the conditions behind the credential exposure were IMDSv1 and overly broad permissions [7]. Both are settings an operator controls.
SANS ran the two items in one episode on October 12, 2026, and states no link between them [11]. We'd rank the gateway first. It has reported ransomware use. The Bedrock item has a vendor fix and a research write-up.
What to watch
- Palo Alto Networks' advisory for CVE-2026-0257: fixed releases and any change to the affected product list.
- Whether ReliaQuest or another vendor names the ransomware groups and a first-exploitation date.
- Whether Zenity, Amazon or anyone else reports use of the Bedrock flaw outside research.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence50
- Adoption
- Insufficient
- Hype gap−10
- Incentives
- Insufficient
- Confidence55
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
ReliaQuest reports ransomware actors exploiting an authentication bypass (CVE-2026-0257) in Palo Alto Networks PAN-OS GlobalProtect and Prisma Access.
- [2]
The ransomware actors use the authentication bypass to open unauthorized VPN sessions.
- [3]
The SANS episode notes cite a ReliaQuest post on X as the source for the report of ransomware exploitation of CVE-2026-0257.
- [4]
The SANS episode notes link Palo Alto Networks' security advisory page for CVE-2026-0257.
- [5]
SANS advises patching VPN gateways and keeping VPN clients updated too.
- [6]
Zenity Labs found a now-fixed server-side request forgery vulnerability in Amazon Bedrock AI agents; a prompt could make an agent fetch and reveal credentials from the EC2 instance metadata service (IMDS).
- [7]
The Bedrock agent credential exposure was made possible by IMDSv1 and overly broad permissions.
- [8]
SANS advises restricting the URLs AI agents can reach and always using IMDSv2.
- [9]
Johannes Ullrich said: "AI agents often have the ability to reach out to other websites in order to retrieve information".
- [10]
Ullrich said an agent's ability to reach other websites is the typical pattern that can be used for server-side request forgery.
- [11]
The SANS Stormcast of Monday, October 12, 2026 covered the GlobalProtect exploitation, the Bedrock Agents SSRF and a segment on Traffic Light Protocol overuse.
Get this ledger inside ChatGPT. Ask about any of our stories and the answer brings its figure, each claim’s verdict and the sources. Free, no account.
Sources
1 independent publisher whose own reporting we read for this story.
- isc.sans.eduhttps://isc.sans.edu/podcastdetail/10132
1 article · October 13, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.
Topics
- AI Agent SecurityFollow
- RansomwareFollow
- VPN vulnerabilitiesFollow
- Cloud SecurityFollow