Unit 42 says Qilin and INC ransomware operators are exploiting PAN-OS flaw CVE-2026-0257 to reach victims' networks

TLDR

• Unit 42 says Qilin and INC ransomware operators are exploiting PAN-OS flaw CVE-2026-0257 to bypass MFA.¹²
• The flaw was patched in May and exploited from May; Unit 42's ransomware investigations date from early June.¹²³⁴
• In one case, attackers moved from the VPN gateway to vCenter and dumped credentials from a domain controller's virtual disk.¹²

Palo Alto Networks' Unit 42 says in an updated threat brief that ransomware operators including Spikey Scorpius (aka Qilin) and Tarnished Scorpius (aka INC) are exploiting CVE-2026-0257, an authentication bypass in the portal and gateway components of PAN-OS that can let unauthorised attackers circumvent security controls and initiate VPN connections.¹ The Hacker News gives the flaw a CVSS score of 7.8, says it also affects Prisma Access, and says it was patched in May 2026 and added to CISA's Known Exploited Vulnerabilities catalogue on 13 May 2026.² Unit 42 says it is also aware of public reporting that attributes exploitation to actors using Settra ransomware, and The Hacker News says ReliaQuest reported days earlier that it had detected both Qilin and Settra exploiting the flaw.¹²

Unit 42 says the attackers use the flaw to gain an initial foothold, bypass multi-factor authentication to establish a VPN session, and then run internal reconnaissance with dual-use remote monitoring and management tools, move laterally over RDP and SMB, and stage tooling for credential harvesting, data exfiltration and ransomware deployment.¹² Its investigations began in early June 2026 and have covered industries including education, financial services, healthcare, government, utilities and energy.¹ Unit 42 calls the most significant change in tactics a direct pivot to the virtualisation layer: in one case attackers moved from the compromised VPN gateway to the vCenter management appliance, disabled the execInstalledOnly control on ESXi hypervisors, and used a custom tool for offline credential dumping against a domain controller's virtual disk, which it says avoids in-guest endpoint detection and response.¹² It also saw this initial access chained with tools targeting Veeam backup infrastructure through CVE-2023-27532.¹² The Hacker News adds that Arctic Wolf flagged Qilin's exploitation of the flaw in July 2026, in attacks ranging from rapid encryption-only operations to full double extortion.²

The brief's earlier section describes an unidentified actor probing GlobalProtect, with only a small portion of the probed devices establishing VPN sessions, and lists nine IP addresses and suspicious host names to search for in GlobalProtect logs.¹ Separately, Unit 42 says its incident response work on the Lunar Peak campaign found organisations mapping GlobalProtect profiles to HTTP and HTTPS services on their management interfaces, which exposes those interfaces to the internet on ports 4443 and 3879, and it advises testing for this from outside and restricting access through Interface Management profiles.¹ Its general advice is to hunt for the published indicators, start incident response for any successful gateway-connected events linked to them, and follow the available workarounds or upgrade to a fixed version.¹²

Why it matters: the flaw has been public and patched since May, yet Unit 42 reports ransomware operators still using it, and the pivot from the VPN gateway into vCenter and ESXi means an unpatched gateway can lead to credential theft that tools running inside guest systems may not see.¹²

Update, 22 October 2026: Follow-up reporting from Help Net Security and The Register sets out how long the flaw has been exploited, and shows the exploitation started in May rather than June. Help Net Security says Palo Alto Networks disclosed CVE-2026-0257 on 13 May with a medium severity rating and on 29 May updated its advisory to say it had become aware of limited exploit attempts on unpatched devices without mitigations.³ It says Rapid7 had by then reported attackers targeting the local administrator account on its customers' devices from 17 May, with some reaching internal networks in a second wave on 21 May.³ The Register gives the same 13 May disclosure and 17 May start for Rapid7's observations, and calls the flaw high-severity, where Help Net Security reports the initial medium rating.³⁴ Unit 42's own investigations of ransomware intrusions linked to the flaw date from early June, which matches the "since June" in both outlets' headlines.³⁴

Help Net Security says the flaw stems from firewalls relying on cookies without detailed validation and integrity checking, and that the affected products include the GlobalProtect portal and gateway of physical and virtual firewalls running PAN-OS, as well as Prisma Access.³ It reports that ReliaQuest tracked exploitation by several groups including Qilin and Settra, found Cobalt Strike, BloodHound and SharpHound in the related activity, and assesses that exploitation is highly likely to continue over the next three months.³ ReliaQuest warns that because access originates through an organisation's own VPN, malicious activity can resemble legitimate remote work.³ Its advice is to upgrade without delay, disable authentication override cookies where they are not needed, end all active GlobalProtect sessions after patching, and investigate unexpected connections, including sessions with hostnames such as "kali", because patching alone may not remove access established earlier.³

The Register says Palo Alto Networks did not respond to its questions about how many organisations have been infected, so no victim count has been published in the sources reviewed.⁴ Unit 42's brief labels its Qilin and INC update as 19 October, and Help Net Security gives the same date, while the brief's title reads "Updated October 20" and The Register says Unit 42 made the statement on Monday.¹³⁴