Palo Alto Networks’ Unit 42 has reported ongoing exploitation of the PAN-OS vulnerability CVE-2026-0257 by ransomware operators, including groups identified as Spikey Scorpius (also known as Qilin) and Tarnished Scorpius (also known as Inc). This vulnerability, which allows for an authentication bypass in GlobalProtect VPN access, has been actively targeted since early June 2026, with significant implications for corporate network security.
Exploitation Details
The CVE-2026-0257 vulnerability enables unauthorized attackers to bypass security controls and establish VPN connections, potentially leading to unauthorized access to sensitive corporate networks. As of October 19, 2026, the exploitation has been linked to actors utilizing Settra ransomware, indicating a trend where attackers gain initial access and subsequently bypass multi-factor authentication (MFA) controls.
Following successful exploitation, these threat actors typically engage in internal reconnaissance using remote monitoring and management (RMM) tools, lateral movement via RDP and SMB, and preparation for credential harvesting and data exfiltration, culminating in ransomware deployment. Notably, the tactics have evolved to include direct attacks on virtualization layers, with one incident involving a pivot from a compromised VPN gateway to a vCenter management appliance, where attackers disabled security controls on ESXi hypervisors.
Indicators of Compromise
Organizations are advised to monitor their GlobalProtect logs for specific indicators of compromise (IoCs). Successful gateway-connected events from suspicious IP addresses, such as 23.128.228[.]6 and 104.207.144[.]154, should be scrutinized. Additionally, unusual host IDs or device names, including WINDOWS-LAPTOP-001 and GP-CLIENT, may indicate malicious activity.
Unit 42 has identified several IP addresses and host configurations associated with this exploitation, which organizations should actively search for in their logs to detect potential breaches.
Recommendations for Organizations
In light of these developments, organizations are urged to implement proactive measures. This includes activating incident response protocols for any suspicious gateway-connected events and reviewing the security advisory for CVE-2026-0257. Following recommended workarounds and upgrading to patched versions of PAN-OS are critical steps to mitigate the risk of exploitation.
For further details on the vulnerability and protective measures, organizations can refer to the official Palo Alto Networks Security Advisory and additional analyses from cybersecurity experts.
As the situation evolves, continued vigilance and prompt action are essential for organizations to safeguard their networks against these sophisticated ransomware threats.
For more information on the ongoing exploitation of CVE-2026-0257, refer to the detailed report by Palo Alto Networks’ Unit 42 here.
