Palo Alto Networks Unit 42 updated its threat brief on CVE-2026-0257 on October 19. The update names two ransomware operators attempting exploitation: Spikey Scorpius, also known as Qilin, and Tarnished Scorpius, also known as Inc. Unit 42 also notes public reporting that ties Settra ransomware actors to the same flaw.
CVE-2026-0257 is an authentication bypass in the portal and gateway components of vulnerable PAN-OS versions. It lets an unauthorized attacker get around security controls and start a GlobalProtect VPN session. CISA added it to the Known Exploited Vulnerabilities catalog on May 13, 2026. A public proof of concept followed on May 29. Unit 42 has been running investigations since early June across healthcare, financial services, government, and utilities and energy.
The notable shift is what happens after the VPN session is up. Unit 42 describes attackers bypassing MFA to connect, then running internal reconnaissance with dual-use RMM tools and moving laterally over RDP and SMB. They stage tooling for credential harvesting, exfiltration, and ransomware deployment.
In one case the attackers pivoted from the VPN gateway to a vCenter appliance. They disabled the execInstalledOnly control on ESXi hypervisors, then dumped credentials offline from a domain controller's VMDK. That approach sits below the guest operating system, so in-guest EDR never sees it. Unit 42 also saw this access chained with exploitation of Veeam backup infrastructure through CVE-2023-27532.
Why it matters: a patched perimeter is not the end of the exercise. Teams that treat the hypervisor layer as out of scope for detection have a blind spot that these groups are already using.
Recommended actions, per Unit 42 and the Palo Alto Networks advisory: apply the listed workarounds or upgrade to a fixed PAN-OS version. Hunt GlobalProtect logs for the published indicators, including the nine IP addresses in the brief and the PoC-derived values of an endpoint OS string of Microsoft Windows 10 Pro 64-bit with an empty source user domain. Treat any matching successful gateway connection as an incident. Beyond the firewall, audit vCenter and ESXi access, alert on changes to execInstalledOnly, restrict management-plane reachability, and patch Veeam. The advisory is the source for CVSS and fixed-version numbers; Unit 42's brief does not state them.
