Palo Alto Networks flags active exploitation of PAN-OS flaw

First reported 19 Oct, 22:35 UTCSource: Palo Alto Networks Unit 42Last editorial activity 19 Oct, 22:35 UTCWrite a comment ↓

Two analysts silhouetted in front of monitors in a security operations center — WORLDTECH illustration · AI-generated (Canva)

Unit 42, the threat intelligence team of Palo Alto Networks, has reported active exploitation of the PAN-OS vulnerability CVE-2026-0257 by an unidentified threat actor attempting to reach GlobalProtect. Public reporting links the flaw to ransomware operators.

How the flaw is being abused

The weakness is an authentication bypass in the portal and gateway components of vulnerable PAN-OS releases. According to the company, it could allow unauthorised intruders to slip past security checks and open virtual private network connections.

Unit 42 says the unidentified actor is trying to reach GlobalProtect through the flaw. Only a small share of the devices it probed went on to establish VPN sessions and produce gateway-connected events.

Ransomware groups named in public reports

Spikey Scorpius (also known as Qilin) and Tarnished Scorpius (also known as Inc), both described as ransomware operators, are exploiting CVE-2026-0257, according to the report. Some public accounts tie the exploitation to actors deploying Settra ransomware, software that encrypts files and demands a payment.

Attackers use the flaw to gain a first foothold in corporate networks, then get past multi-factor authentication controls to set up a VPN session. In one notable case they moved from the compromised VPN gateway to a vCenter management appliance.

What is confirmed and what is not

The flaw was added to the KEV catalog on May 13, 2026. Unit 42 has not identified any post-access behavior or lateral movement so far. Palo Alto Networks says its Cortex Xpanse can identify publicly exposed PAN-OS gateways and GlobalProtect portals, and that customers can use product protections against the threat.

Open questions

Who is the unidentified threat actor behind the activity?
Will post-access behavior or lateral movement be identified?

Key facts

Palo Alto Networks Unit 42 has observed active exploitation of CVE-2026-0257 in PAN-OS.

The flaw was added to the KEV catalog on May 13, 2026.

Ransomware operators Spikey Scorpius (aka Qilin) and Tarnished Scorpius (aka Inc) are reported to be exploiting it.

The vulnerability is an authentication bypass in the portal and gateway components that could let attackers start VPN connections.

No post-access behavior or lateral movement has been identified so far.