Active Exploitation of May 2026 PAN-OS CVE-2026-0257 (Updated October 20) | #ransomware | #cybercrime

Executive Summary
October 19 Update
Unit 42 has observed attempted exploitation of the May 2026 CVE-2026-0257 by ransomware operators, including Spikey Scorpius (aka Qilin) and Tarnished Scorpius (aka Inc).
We’re also aware of public reporting attributing exploitation to threat actors using Settra ransomware.
Fixes for this vulnerability have been available since May 2026. Palo Alto Networks has become aware of limited exploit attempts on unpatched PAN-OS devices without mitigations applied.
Customers can mitigate the risk of this issue by taking any of the following actions:

Use a dedicated certificate for Authentication Override cookies: Generate a new certificate exclusively for authentication override cookies and store it securely. Do not reuse the portal or gateway certificate, and do not share this certificate with other features or users.
Disable Authentication Override: Uncheck the Authentication Override options (for generating and accepting cookies) in the GlobalProtect portal and gateway configuration.

June 5, 2026
In June 2026, Palo Alto Networks Unit 42 observed active exploitation of the May 2026 PAN-OS vulnerability CVE-2026-0257 by an unidentified threat actor attempting to access GlobalProtect. This security flaw involves an authentication bypass in the portal and gateway components of vulnerable versions of PAN-OS® software, which could allow unauthorized attackers to circumvent security controls and initiate virtual private network (VPN) connections.
This CVE was added to the Known Exploited Vulnerability (KEV) catalog on May 13, 2026.
No post-access behavior or lateral movement was identified. Only a small portion of the probed devices actually established VPN sessions, resulting in gateway-connected events.
We advise organizations to proactively hunt for the indicators of the activity specified in this report and activate incident response protocols for any successful gateway-connected events linked to these indicators. Additionally, we strongly recommend reviewing the security advisory for CVE-2026-0257, following the available workarounds and mitigations or upgrading to a version that includes a fix for this issue.
For pre-proof-of-concept release (May 29, 2026) activities, search for these IP addresses in GlobalProtect logs to look for successful login connection:

23.128.228[.]6
104.207.144[.]154
146.19.216[.]119
146.19.216[.]120
146.19.216[.]125
179.43.172[.]213
185.195.232[.]139
198.12.106[.]60
202.144.192[.]47

Search GlobalProtect logs for successful gateway-connected events from any IP address using suspicious host IDs or device names, including but not limited to:

aa:bb:cc:dd:ee:ff
00:11:22:33:44:55
WINDOWS-LAPTOP-001
DESKTOP-GP01
GP-CLIENT

As part of post-PoC release monitoring, search GlobalProtect logs for successful gateway-connected events matching the following hard-coded client configuration values from the PoC code.

endpoint_os_version : Microsoft Windows 10 Pro 64-bit
source_user_info.domain : empty

We encourage organizations to consult our official Palo Alto Networks Security Advisory for additional details about the vulnerability and configuration guidance. We also recommend reading Rapid7’s technical analysis about the exploitation activity they observed in the wild.
Palo Alto Networks Cortex Xpanse is able to identify publicly exposed PAN-OS gateways and GlobalProtect portals.
Management Interface Exposure Risk and Remediation
During incident response (IR) engagements associated with the Lunar Peak campaign, Unit 42 observed a recurring misconfiguration that led to critical, unintended exposure. Specifically, organizations frequently mapped GlobalProtect (GP) profiles to HTTP/HTTPS services on their management interfaces.
This configuration inadvertently exposes the management interface to the internet on specific ports, most notably 4443 and 3879, often without administrators’ knowledge. While the risks of this exposure were previously documented, the frequency of this oversight during the Lunar Peak incidents prompted a comprehensive update to our official guidance to ensure maximum clarity.
Verification and mitigation:

Verify exposure: Defenders can rapidly verify whether their environments are affected by attempting an out-of-band HTTPS connection to their management IP address on ports 4443 and 3879 via an external web browser.
Remediate: To remediate this issue and enforce the principle of least privilege, we strongly advise administrators to review official Palo Alto Networks documentation on configuring Interface Management profiles to safely restrict access.

Update: Oct. 19, 2026
Ransomware operators exploiting the May 2026 CVE-2026-0257 include Spikey Scorpius (aka Qilin) and Tarnished Scorpius (aka Inc). Public reporting attributes exploitation to threat actors using Settra ransomware.
Attackers are leveraging this vulnerability to gain an initial foothold into corporate networks, subsequently bypassing multi-factor authentication (MFA) controls to establish a VPN session. Following this, the threat actors are typically:

Conducting internal network reconnaissance using dual-use remote monitoring and management (RMM) tools
Moving laterally via RDP and SMB
Staging additional tooling for credential harvesting, data exfiltration and ultimately, ransomware deployment

Our investigations have continued since early June 2026, and have spanned across numerous industries, including:

Education
Financial services
Healthcare
High technology
Hospitality
Manufacturing
Professional and legal services
Government
Transportation and logistics
Utilities and energy
Wholesale and retail

The most significant evolution in tactics, techniques and procedures (TTPs) following successful exploitation of CVE-2026-0257 is the direct pivot to the virtualization layer. In one notable case, attackers moved from the compromised VPN gateway to the vCenter management appliance. From there, they disabled security controls on ESXi hypervisors (execInstalledOnly) and used a custom tool to perform offline credential dumping directly against a domain controller’s virtual disk (VMDK).
This tactic bypasses in-guest endpoint detection and response (EDR) and security controls, representing a highly sophisticated method for obtaining domain-wide credentials. We have also observed actors chaining this initial access with other exploit tools, such as those targeting Veeam backup infrastructure (CVE-2023-27532), to maximize their impact.
Conclusion
Palo Alto Networks shared our findings with our fellow Cyber Threat Alliance (CTA) members. CTA members use this intelligence to rapidly deploy protections to their customers and to systematically disrupt malicious cyber actors. Learn more about the Cyber Threat Alliance.
We will update this threat brief as more relevant information becomes available.
The products listed below can help protect PANW customers against exploits targeting CVE-2026-0257.
Palo Alto Networks Product Protections for PAN-OS CVE-2026-0257
Palo Alto Networks customers can leverage a variety of product protections and updates to identify and defend against this threat.
Organizations can access tailored adversary intelligence, direct analyst consultations, and specialized exposure tracking through Unit 42 Threat Intel Services and its Deep and Dark Web Service.
If you think you might have been compromised or have an urgent matter, get in touch with the Unit 42 Incident Response team or call:

North America: Toll Free: +1 (866) 486-4842 (866.4.UNIT42)
UK: +44.20.3743.3660
Europe and Middle East: +31.20.299.3130
Asia: +65.6983.8730
Japan: +81.50.1790.0200
Australia: +61.2.4062.7950
India: 000 800 050 45107
South Korea: +82.080.467.8774

Cloud-Delivered Security Services for the Next-Generation Firewall
Advanced URL Filtering and Advanced IP Defense are designed to identify known IP addresses associated with this activity as malicious.
Cortex AgentiX
Security analysts can use natural language to prompt the Cortex AgentiX Threat Intel agent to extract file indicators from this threat brief. They can then enrich them, check for sightings in their Cortex tenant and related alerts, and provide a quick summary of the impact to the organization.
Cortex XDR and XSIAM
Cortex XDR and XSIAM are designed to provide comprehensive protections for endpoint attacks. It helps block post-exploit activity with its Behavioral Threat Protection, AI-driven local analysis, cloud-based malware analysis and other security engines across Windows, Linux, and Mac systems.
Cortex Xpanse
Cortex Xpanse has the ability to identify exposed PANOS devices on the public internet and escalate these findings to defenders. Customers can enable alerting on this risk by ensuring that the PAN-OS Device Attack Surface Rule is enabled. Identified findings can either be viewed in the Threat Response Center or in the incident view of Expander. These findings are also available for Cortex XSIAM customers who have purchased the ASM module.
Indicators of the Activity
IP Addresses