Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257
Ransomware operators including Qilin and Inc are actively exploiting CVE-2026-0257, a GlobalProtect authentication bypass in Palo Alto Networks PAN-OS, Unit 42 reports in an October 19 update. Attackers use the flaw to establish VPN sessions that bypass MFA, and in one case moved from the gateway to the victim’s vCenter to dump domain credentials from a virtual disk. https://unit42.paloaltonetworks.com/active-exploitation-of-pan-os-cve-2026-0257/
Unit 42Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257 (Updated October 19)Ransomware operators including Spikey Scorpius (aka Qilin) and Tarnished Scorpius (aka Inc) are exploiting PAN-OS vulnerability CVE-2026-0257.