Ransomware Groups Exploit PAN-OS Authentication Bypass CVE-2026-0257
Attackers are actively abusing a PAN-OS flaw to bypass MFA and establish VPN sessions, with ransomware operators including Qilin and Inc involved.
Key points
- Ransomware operators including Spikey Scorpius and Tarnished Scorpius are exploiting CVE-2026-0257.
- The vulnerability allows authentication bypass in GlobalProtect portal and gateway components.
- Attackers pivot from compromised gateways to virtualization layers to dump credentials.
Ransomware operators are actively exploiting an authentication bypass vulnerability in Palo Alto Networks PAN-OS software. Unit 42 researchers reported on October 19 that threat actors associated with Spikey Scorpius and Tarnished Scorpius are leveraging CVE-2026-0257 to access corporate networks.
The flaw resides in the portal and gateway components of vulnerable PAN-OS versions, allowing attackers to circumvent security controls. This enables unauthorized users to initiate virtual private network connections without valid credentials, effectively bypassing multi-factor authentication protections.
Exploitation Tactics and Evolution
Attackers use this vulnerability to gain an initial foothold, then conduct internal reconnaissance using remote monitoring tools. They stage additional software for credential harvesting and data exfiltration before deploying ransomware. This activity has been observed across numerous industries since early June 2026.
A significant tactical evolution involves attackers pivoting directly to the virtualization layer after compromising a VPN gateway. In one case, threat actors moved to a vCenter management appliance to disable security controls on ESXi hypervisors.
From the hypervisor, attackers used a custom tool to perform offline credential dumping against a domain controller's virtual disk. This method bypasses in-guest endpoint detection and response controls, allowing sophisticated actors to obtain domain-wide credentials without triggering standard alerts.
Affected Systems and Attribution
Public reporting also attributes exploitation of CVE-2026-0257 to threat actors using Settra ransomware. The vulnerability was added to the Known Exploited Vulnerability catalog on May 13, 2026. Only a small portion of probed devices successfully established VPN sessions during the observed attacks.
Actors have chained this initial access with other exploit tools, such as those targeting Veeam backup infrastructure via CVE-2023-27532. This combination maximizes impact by compromising both network entry points and backup data sources.
What should you do?
Organizations should proactively hunt for indicators specified in Unit 42’s report and activate incident response protocols for successful gateway-connected events. Review the security advisory for CVE-2026-0257 and follow available workarounds or upgrade to a fixed version.
Search GlobalProtect logs for successful connections from suspicious host IDs or device names. For post-proof-of-concept monitoring, look for hard-coded client configuration values such as Microsoft Windows 10 Pro 64-bit endpoint OS versions.
Background: Endpoint detection and response (EDR)
Endpoint detection and response examples include blocking PowerShell scripts that download payloads, isolating devices showing abnormal memory access, and rolling back file changes. These tools monitor behavior, not just signatures, to stop advanced threats that evade standard security controls.
Read the full guide: Endpoint Detection and Response Examples: How EDR Stops Hidden Threats
What to do and how to stay safe: Palo Alto Networks
- Search GlobalProtect logs for successful gateway-connected events originating from IP addresses using suspicious host IDs or device names.
- Monitor for connections matching hard-coded client configuration values from public proof-of-concept code, such as specific Windows 10 Pro endpoint OS versions.
- Activate incident response protocols for any successful VPN sessions linked to indicators associated with known ransomware operators.
- Consult the official Palo Alto Networks Security Advisory for CVE-2026-0257 to implement recommended workarounds or upgrade to a patched version.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-0257?
It is an authentication bypass vulnerability in the portal and gateway components of PAN-OS software that allows attackers to circumvent security controls and initiate VPN connections.
Which ransomware groups are exploiting this flaw?
Unit 42 observed exploitation by Spikey Scorpius (aka Qilin) and Tarnished Scorpius (aka Inc), while public reporting attributes activity to actors using Settra ransomware.
How do attackers escalate privileges after initial access?
Attackers pivot to the virtualization layer, disabling controls on ESXi hypervisors to perform offline credential dumping against domain controller virtual disks.
