Threat Brief: Active Exploitation of PAN

Executive Summary October 19 Update: Unit 42 continues to observe attempted exploitation of CVE-2026-0257 by ransomware operators including Spikey Scorpius (aka Qilin) and Tarnished Scorpius (aka Inc). We’re also aware of public reporting attributing exploitation to threat actors using Settra ransomware. Palo Alto Networks Unit 42 has observed active exploitation of PAN-OS vulnerability CVE-2026-0257 by an unidentified threat actor attempting to access GlobalProtect. This security flaw involves an authentication bypass in the portal and gateway components of vulnerable versions of PAN-OS® software, which could allow unauthorized attackers to circumvent security controls and initiate virtual private network (VPN) connections. This CVE was added to the Known Exploited Vulnerability (KEV) catalog on May 13, 2026. No post-access behavior or lateral movement has been identified as of this time. Only a small portion of the probed devices actually established VPN sessions, resulting in gateway-connected events. We advise organizations to proactively hunt for the indicators of the activity specified in this report and activate incident response protocols for any successful gateway-connected events linked to these indicators. Additionally, we strongly recommend reviewing the security advisory for CVE-2026-0257, following the available workarounds and mitigations or upgrading to a version that includes a fix for this issue. For pre-proof of concept release (May 29, 2026) activities, search for these IP addresses in GlobalProtect logs to look for successful login connection: - 23.128.228[.]6 - 104.207.144[.]154 - 146.19.216[.]119 - 146.19.216[.]120 - 146.19.216[.]125 - 179.43.172[.]213 - 185.195.232[.]139 - 198.12.106[.]60 - 202.144.192[.]47 Search GlobalProtect logs for successful gateway-connected events from any IP address using suspicious host IDs or device names, including but not limited to: - aa:bb:cc:dd:ee:ff - 00:11:22:33:44:55 - WINDOWS-LAPTOP-001 - DESKTOP-GP01 - GP-CLIENT As part of post-PoC release monitoring, search GlobalProtect logs for successful gateway-connected events matching the following hard-coded client configuration values from the PoC code. - endpoint_os_version : Microsoft Windows 10 Pro 64-bit - source_user_info.domain : empty We encourage organizations to consult our official Palo Alto Networks Security Advisory for additional details about the vulnerability, impacted products and configuration guidance. We also recommend reading Rapid7’s technical analysis about the exploitation activity they observed in the wild. Palo Alto Networks Cortex Xpanse is able to identify publicly exposed PAN-OS gateways and GlobalProtect portals. Update: Oct. 19, 2026 Ransomware operators exploiting CVE-2026-0257 include Spikey Scorpius (aka Qilin) and Tarnished Scorpius (aka Inc). Public reporting attributes exploitation to threat actors using Settra ransomware. Attackers are leveraging this vulnerability to gain an initial foothold into corporate networks, subsequently bypassing multi-factor authentication (MFA) controls to establish a VPN session. Following this, the threat actors are typically: - Conducting internal network reconnaissance using dual-use remote monitoring and management (RMM) tools - Moving laterally via RDP and SMB - Staging additional tooling for credential harvesting, data exfiltration and ultimately, ransomware deployment Our investigations have been ongoing since early June 2026 and have spanned across numerous industries, including: - Education - Financial services - Healthcare - High technology - Hospitality - Manufacturing - Professional and legal services - Government - Transportation and logistics - Utilities and energy - Wholesale and retail The most significant evolution in tactics, techniques and procedures (TTPs) following successful exploitation of CVE-2026-0257 is the direct pivot to the virtualization layer. In one notable case, attackers moved from the compromised VPN gateway to the vCenter management appliance. From there, they disabled security controls on ESXi hypervisors (execInstalledOnly) and used a custom tool to perform offline credential dumping directly against a domain controller's virtual disk (VMDK). This tactic bypasses in-guest endpoint detection and response (EDR) and security controls, representing a highly sophisticated method for obtaining domain-wide credentials. We have also observed actors chaining this initial access with other exploit tools, such as those targeting Veeam backup infrastructure (CVE-2023-27532), to maximize their impact. Conclusion Palo Alto Networks has shared our findings with our fellow Cyber Threat Alliance (CTA) members. CTA members use this intelligence to rapidly deploy protections to their customers and to systematically disrupt malicious cyber actors. Learn more about the Cyber Threat Alliance. We will update this threat brief as more relevant information becomes available. The products listed below can help protect PANW customers against exploits targeting CVE-2026-0257. Palo Alto Networks Product Protections for PAN-OS CVE-2026-0257 Palo Alto Networks customers can leverage a variety of product protections and updates to identify and defend against this threat. Organizations can access tailored adversary intelligence, direct analyst consultations, and specialized exposure tracking through Unit 42 Threat Intel Services and its Deep and Dark Web Service. If you think you might have been compromised or have an urgent matter, get in touch with the Unit 42 Incident Response team or call: - North America: Toll Free: +1 (866) 486-4842 (866.4.UNIT42) - UK: +44.20.3743.3660 - Europe and Middle East: +31.20.299.3130 - Asia: +65.6983.8730 - Japan: +81.50.1790.0200 - Australia: +61.2.4062.7950 - India: 000 800 050 45107 - South Korea: +82.080.467.8774 Cloud-Delivered Security Services for the Next-Generation Firewall Advanced URL Filtering and Advanced IP Defense are designed to identify known IP addresses associated with this activity as malicious. Cortex AgentiX Security analysts can use natural language to prompt the Cortex AgentiX Threat Intel agent to extract file indicators from this threat brief. They can then enrich them, check for sightings in their Cortex tenant and related alerts, and provide a quick summary of the impact to the organization. Cortex XDR and XSIAM Cortex XDR and XSIAM are designed to provide comprehensive protections for endpoint attacks. It helps block post-exploit activity with its Behavioral Threat Protection, AI-driven local analysis, cloud-based malware analysis and other security engines across Windows, Linux, and Mac systems. Cortex Xpanse Cortex Xpanse has the ability to identify exposed PANOS devices on the public internet and escalate these findings to defenders. Customers can enable alerting on this risk by ensuring that the PAN-OS Device Attack Surface Rule is enabled. Identified findings can either be viewed in the Threat Response Center or in the incident view of Expander. These findings are also available for Cortex XSIAM customers who have purchased the ASM module. Indicators of the Activity IP Addresses - 23.128.228[.]6 - 104.207.144[.]154 - 146.19.216[.]119 - 146.19.216[.]120 - 146.19.216[.]125 - 179.43.172[.]213 - 185.195.232[.]139 - 198.12.106[.]60 - 202.144.192[.]47 Host Names and Mac Addresses - aa:bb:cc:dd:ee:ff - 00:11:22:33:44:55 - WINDOWS-LAPTOP-001 - DESKTOP-GP01 - GP-CLIENT Additional Resources - ReliaQuest Threat Research – ReliaQuest - Cookie Crumbles: How Exploitation of CVE-2026-0257 Leads to Qilin Ransomware – Arctic Wolf - CVE-2026-0257: PAN-OS GlobalProtect Authentication Bypass - Arctic Wolf - CVE-2026-0257 PAN-OS: GlobalProtect Authentication Bypass Vulnerabilities – Palo Alto Networks - Rapid7 Observed Exploitation of PAN-OS GlobalProtect Authentication Bypass Vulnerability (CVE-2026-0257) – Rapid 7 - Known Exploited Vulnerabilities Catalog – U.S. Cybersecurity & Infrastructure Security Agency (CISA) Updated June 9, 2026, at 11:45 a.m. PT to add XDR and XSIAM product coverage. Updated October 19, 2026, at 4:00 p.m. PT to add recent ransomware group activity.