Ransomware groups exploit PAN-OS CVE-2026-0257 for VPN access

Ransomware cartels Qilin (Spikey Scorpius) and Settra, along with Tarnished Scorpius (Inc), are actively exploiting CVE-2026-0257 in Palo Alto Networks PAN-OS to gain initial VPN access, as reported by Unit 42.

Palo Alto Networks disclosed CVE-2026-0257 on May 13, 2026, describing it as an authentication bypass in GlobalProtect and Prisma Access that allows attackers to start VPN sessions without proper authorization. Unit 42 says the vulnerability was added to the CISA Known Exploited Vulnerabilities catalog on May 13, 2026, while ReliaQuest cites a May 29, 2026, addition. Fixed versions of PAN-OS were released after disclosure, and the vendor urged deployment to mitigate the threat.

After initial foothold via CVE-2026-0257, attackers bypass MFA to establish a VPN session, then conduct internal network reconnaissance using dual‑use remote monitoring and management tools. They move laterally via RDP and SMB, stage additional tooling for credential harvesting, data exfiltration and ransomware deployment, and pivot directly to the virtualization layer.

In one observed incident, threat actors went to the vCenter management appliance from a breached VPN gateway, then disabled ESXi hypervisor protections (the execInstalledOnly setting) and employed a custom tool to dump credentials offline from a domain controller’s VMDK. This bypasses in‑guest endpoint detection and response and security controls, providing a highly sophisticated method for obtaining domain‑wide credentials.

Attackers have also chained the initial access with exploit tools targeting Veeam backup infrastructure (CVE-2023-27532) to increase impact. Investigations of CVE-2026-0257 exploitation have been ongoing since early June 2026, and as of the October 19 update, no post‑access behavior or lateral movement was seen; only a small portion of probed devices established VPN sessions.

Affected industries include education, financial services, healthcare, high technology, hospitality, manufacturing, professional and legal services, government, transportation and logistics, as well as utilities, energy, wholesale and retail. Ransomware cartels continue to target CVE-2026-0257 despite a security patch being available five months prior, according to ReliaQuest.

Indicators of compromise include specific IP addresses observed in successful GlobalProtect logins: 23.128.228[.]6, 104.207.144[.]154, 146.19.216[.]119, 146.19.216[.]120, 146.19.216[.]125, 179.43.172[.]213, 185.195.232[.]139, 198.12.106[.]60, 202.144.192[.]47. Analysts also advise searching for suspicious host IDs or device names such as aa:bb:cc:dd:ee:ff, 00:11:22:33:44:55, WINDOWS-LAPTOP-001, DESKTOP-GP01 and GP-CLIENT.

As part of post‑POC release monitoring, defenders should look for successful gateway‑connected events where endpoint_os_version is Microsoft Windows 10 Pro 64‑bit, or where source_user_info.domain is empty. Palo Alto Networks Cortex Xpanse can identify publicly exposed PAN-OS gateways and GlobalProtect portals, and Cortex XDR and XSIAM provide endpoint protections that block post‑exploit activity via Behavioral Threat Protection and AI‑driven analysis.

Organizations should upgrade to fixed PAN-OS versions, follow available mitigations or workarounds, and consult the Palo Alto Networks Security Advisory for CVE-2026-0257. Additional steps include disabling authentication override cookies where not required, terminating all active GlobalProtect sessions after patching, and investigating unexpected connections—including sessions using hostnames such as ‘kali’—because patching alone may not remove access established before remediation.

Unit 42 advises hunting for indicators of activity and activating incident response for any successful gateway‑connected events linked to those indicators. The vendor has shared findings with Cyber Threat Alliance members, who use the intelligence to deploy protections and disrupt malicious actors. Defenders can also access adversary intelligence, analyst consultations and exposure tracking through Unit 42 Threat Intel Services and its Deep and Dark Web Service.

ReliaQuest warned on October 9 that Qilin and Settra ransomware cartels target CVE-2026-0257 for unauthorized VPN access and initial entry, and confirmed the cartels’ active use of offensive security tools such as Cobalt Strike, BloodHound and SharpHound. ReliaQuest assessed it highly likely that these cartels will continue exploitation attempts over the next three months. Since the breach uses the organization’s VPN, the actions appear as normal remote work and can remain unnoticed until attackers steal credentials, move laterally, exfiltrate data or deploy ransomware.

The US National Vulnerability Database assigned CVE-2026-0257 a critical severity rating of 9.1. The vulnerability affects PAN-OS versions 10.2.0, 11.1.0, 11.2.0 and 12.1.0, as well as two versions of Prisma Access (10.2.0 and 11.2.0). The advisory was updated on June 9, 2026, at 11:45 a.m. PT to add XDR and XSIAM product coverage, and again on October 19, 2026, at 4:00 p.m. PT to include recent ransomware cartel activity.