Qilin and Inc exploit PAN-OS GlobalProtect bypass CVE-2026-0257
Original title: Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257 (Updated October 19)
Unit 42 says operators bypass MFA for VPN access, then move via RDP and SMB toward ransomware.
Unit 42 says ransomware operators including Spikey Scorpius (Qilin) and Tarnished Scorpius (Inc) are exploiting PAN-OS CVE-2026-0257, an authentication bypass in GlobalProtect portal and gateway components. Attackers bypass MFA, open VPN sessions, then use RMM tools, RDP and SMB before staging ransomware. In one case they reached vCenter, disabled ESXi execInstalledOnly and dumped domain credentials from a VMDK. The CVE entered CISA's KEV catalog on May 13, 2026.
Unconfirmed: Settra ransomware attribution comes from public reporting, not Unit 42's own observation.
- Only a small share of probed devices established gateway-connected VPN sessions.
- Investigations since early June 2026 cover healthcare, government, energy and other sectors.
- Actors have chained access with tools targeting Veeam CVE-2023-27532.
- Public reporting, not Unit 42, links some exploitation to Settra ransomware.
- Pre-PoC hunting covers listed source IPs and host IDs such as WINDOWS-LAPTOP-001.
Impact: Authentication bypass to start GlobalProtect VPN sessions
| Product | Affected |
|---|---|
| Palo Alto Networks PAN-OS | vulnerable GlobalProtect portal and gateway versions |
- 1.Upgrade PAN-OS to a fixed version or apply the advisory workarounds.
- 2.Hunt GlobalProtect logs for the listed IPs, host IDs and PoC client values.
- 3.Start incident response for successful gateway-connected events tied to those indicators.
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1133 External Remote ServicesT1021.001 Remote Desktop ProtocolT1021.002 SMB/Windows Admin SharesT1003 OS Credential Dumping
- Vendors
- Palo Alto Networks
- Products
- PAN-OSGlobalProtect
- Threat actors
- Spikey ScorpiusQilinTarnished ScorpiusInc
- Malware
- Settra
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2023-27532 | Missing Authentication in Veeam Backup & Replication Exposes Stored Credentials | 7.5 | 81% | KEVRansomware | KEV |
| CVE-2026-0257 | Authentication Bypass in Palo Alto Networks PAN-OS GlobalProtect Portal and Gateway | 7.8 | 97% | KEVRansomware | KEV |
From the original article
5 min read at unit42.paloaltonetworks.com
Ransomware operators including Spikey Scorpius (aka Qilin) and Tarnished Scorpius (aka Inc) are exploiting PAN-OS vulnerability CVE-2026-0257. The post Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257 (Updated October 19) appeared first on Unit 42.
By Andy Piazza and Unit 42 · unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.