Ransomware Gangs Exploit Palo Alto CVE-2026-0257

Ransomware crews including Qilin and Inc are exploiting a Palo Alto Networks firewall flaw that was disclosed and patched in May, the company’s Unit 42 threat intelligence team said in an update dated 19 October. The bug, CVE-2026-0257, lets attackers slip past login checks on GlobalProtect VPN portals and gateways and open a VPN connection into a corporate network.

This is not a new zero-day. Palo Alto published its advisory on 13 May, and the US cybersecurity agency CISA added the bug to its Known Exploited Vulnerabilities catalogue the same day, according to Unit 42. What is new is who is using it: organised ransomware groups, turning unpatched firewalls into a front door. Any organisation still running a vulnerable version of PAN-OS with GlobalProtect is exposed.

In brief

Unit 42 says ransomware crews including Qilin and Inc are exploiting CVE-2026-0257, a PAN-OS GlobalProtect authentication bypass patched in May.
Attackers use it to get past MFA, open a VPN session and, in one case, pivot to VMware infrastructure to steal domain-wide credentials.
No victim count has been published; Palo Alto advises upgrading to a fixed version or applying its workarounds.

How the attacks unfold

Unit 42 says it “continues to observe attempted exploitation of CVE-2026-0257 by ransomware operators including Spikey Scorpius (aka Qilin) and Tarnished Scorpius (aka Inc).” Its investigations “have been ongoing since early June 2026 and have spanned across numerous industries”, from education and healthcare to government, manufacturing and utilities.

The pattern starts at the VPN. “Attackers are leveraging this vulnerability to gain an initial foothold into corporate networks, subsequently bypassing multi-factor authentication (MFA) controls to establish a VPN session,” Unit 42 says. From there, the crews typically scout the network with remote monitoring and management tools, move laterally over RDP and SMB, and stage tools for credential theft, data exfiltration and, finally, ransomware.

The most worrying step is a jump into the virtual machines that run the business. “In one notable case, attackers moved from the compromised VPN gateway to the vCenter management appliance,” Unit 42 says. “From there, they disabled security controls on ESXi hypervisors (execInstalledOnly) and used a custom tool to perform offline credential dumping directly against a domain controller’s virtual disk (VMDK).”

That matters because it sidesteps the security software inside each machine. Unit 42 calls it “a highly sophisticated method for obtaining domain-wide credentials”, and says crews have also chained the access with other exploits, such as one for Veeam backup software tracked as CVE-2023-27532.

From quiet advisory to ransomware tool

The bug’s history explains the delay. Palo Alto disclosed and patched it on 13 May and first rated it medium severity, The Register reported. By the end of May, Rapid7 said it had seen successful exploitation “dating back to at least May 17”, according to the same report. Unit 42 notes that a proof-of-concept exploit was released on 29 May.

Other groups appear to be joining in. ReliaQuest analysts say “multiple threat groups”, including operators of Settra ransomware, are exploiting the flaw, The Register reported.

How many organisations have been hit is unknown. Palo Alto “did not respond to The Register’s inquiries about the attacks, including how many organizations have been infected,” the publication said, and Unit 42’s brief gives no victim count.

Date (2026)	Event
13 May	Palo Alto advisory and fix; added to CISA KEV
17 May	Earliest successful exploitation seen by Rapid7
29 May	Proof-of-concept exploit released
Early June	Unit 42 investigations begin
19 Oct	Unit 42 names Qilin and Inc

Sources: Palo Alto Networks advisory; Unit 42; The Register, citing Rapid7.

What to do now

The fix is straightforward: patch. Palo Alto’s advisory lists fixed releases for each supported branch, including PAN-OS 12.1.7, 11.2.12, 11.1.15 and 10.2.18-h6 or later. The flaw affects firewalls with a GlobalProtect portal or gateway “when authentication override cookies are enabled and a specific certificate configuration exists,” the advisory says, and Panorama and Cloud NGFW are unaffected.

If upgrading has to wait, the advisory offers two workarounds: use a dedicated certificate solely for authentication override cookies, or turn off Authentication Override in the portal and gateway settings. Users will need to sign in again after the upgrade, it adds.

Patching alone may be too late for some. Unit 42 urges organisations to hunt for the indicators listed in its brief and to trigger incident response for any successful gateway connection linked to them.

Our read

This is TSN’s analysis. Five months between a patch and named ransomware crews is a familiar gap for edge devices, and it shows how long VPN gateways stay unpatched. The pivot to the hypervisor layer is the bigger lesson: once attackers reach vCenter, endpoint tools inside the virtual machines see nothing. Teams that patched late should assume compromise and check, not just upgrade.