Active Exploitation of PAN-OS CVE-2026-0257: Ransomware Groups Target VPN Gateways
Security researchers have confirmed ongoing, active exploitation of a critical authentication bypass vulnerability in PAN-OS software, identified as CVE-2026-0257. The flaw, which affects the portal and gateway components of GlobalProtect, allows unauthorized threat actors to circumvent security controls and establish unauthorized VPN sessions. Since its discovery, the vulnerability has been added to the Known Exploited Vulnerability (KEV) catalog, prompting urgent warnings for organizations to assess their exposure and implement necessary patches.
Tactical Evolution in Ransomware Operations
As of October 19, 2026, investigations have linked the exploitation of CVE-2026-0257 to multiple ransomware syndicates, including groups identified as Spikey Scorpius (Qilin) and Tarnished Scorpius (Inc). Additionally, reports indicate that actors deploying Settra ransomware are leveraging the same exploit to gain an initial foothold into enterprise environments. By bypassing multi-factor authentication (MFA) via the VPN gateway, these adversaries are successfully infiltrating corporate networks across diverse sectors, including healthcare, finance, manufacturing, and government.
Once inside the network, attackers have demonstrated a sophisticated progression of tactics, techniques, and procedures (TTPs). Following initial access, threat actors typically conduct internal reconnaissance using remote monitoring and management (RMM) tools, move laterally through the network via RDP and SMB protocols, and stage infrastructure for credential harvesting and data exfiltration.
Pivot to the Virtualization Layer
A particularly concerning development in this campaign is the attackers’ direct pivot to the virtualization layer. In several observed instances, threat actors moved from the compromised GlobalProtect gateway to the vCenter management appliance. By disabling security controls on ESXi hypervisors, they were able to use custom tooling to perform offline credential dumping directly against a domain controller’s virtual disk (VMDK). This method effectively bypasses standard in-guest endpoint detection and response (EDR) solutions, providing attackers with a highly effective path to obtaining domain-wide administrative credentials.
Furthermore, researchers have noted that these actors are chaining this initial access with other known exploits, such as those targeting backup infrastructure, to maximize the operational impact of their intrusions. The breadth of the campaign has necessitated a coordinated response, with intelligence being shared among members of the Cyber Threat Alliance to facilitate faster detection and disruption of these malicious activities.
Mitigation and Defensive Recommendations
Organizations are urged to review their security posture immediately. The primary defense remains applying the official security updates provided by the vendor. For organizations unable to patch immediately, it is critical to follow the documented workarounds and mitigations provided in the official security advisory.
Defenders should proactively hunt for indicators of compromise, including specific IP addresses and suspicious host identifiers or device names associated with the exploit traffic. Monitoring GlobalProtect logs for successful gateway-connected events that exhibit anomalous characteristics—such as empty domain fields or specific hard-coded configuration values—can assist in identifying potential breaches. Organizations are also encouraged to utilize external attack surface management tools to identify and secure any publicly exposed PAN-OS gateways that may be vulnerable to this ongoing threat.
