Discovered and subsequently patched in May of this year, CVE-2026-0257 is an authentication bypass in Palo Alto Networks’ PAN-OS software. The flaw enables bad actors to establish unauthorized VPN connections that bypass multi-factor authentication (MFA) steps. Palo Alto Networks’ Unit 42 research team published knowledge of active exploitation of the vulnerability in June, and recently put out an updated report on active exploitation ongoing into late October.
The Actors Behind the Attack
The Unit 42 publication names two ransomware operator groups as being behind the recent exploitation: Qilin, also known as Spikey Scorpius, and INC, also known as Tarnished Scorpius. The report also cites external claims from ReliaQuest Threat Research tying the Settra ransomware operation to the attacks. This research states that the flaw is likely going to continue being exploited in the coming months as more threat actors attempt to target unpatched software.
Unit 42’s research into the active exploitation of this vulnerability has been ongoing since June, examining how the threat activity is carried out and who the attackers typically target. The October update to the report cites a number of industries where the exploitation of this flaw has been focused, including healthcare, finance, manufacturing, government, and energy.
Gaining and Deepening Access
The flaw that Palo Alto Networks patched in May allows attackers to bypass security restraints like MFA processes and establish a foothold within the targeted corporate network. Once inside, threat actors have been observed conducting a variety of further malicious actions. They typically achieve lateral movement through Remote Desktop Protocol and Server Message Block processes.
Attackers often carry out reconnaissance efforts on target systems, using remote monitoring and management (RMM) tools. They obtain access to the vCenter management appliance and disable security controls on ESXi hypervisors. They also stage further tooling for a wide range of activity, including credential harvesting, data exfiltration, and ransomware deployment. Domain-wide credentials are extracted directly from a virtual disk, circumventing endpoint detection and response (EDR) and security controls.
Activity Invisible to the Security Stack
One of the most significant factors in these attacks is the evasion of security tools. There is no endpoint agent on the appliance or the hypervisor to catch the attackers’ suspicious and malicious behavior. The compromised device itself is the security control needed to prevent intrusion. Any endpoint tools that an organization has in place to protect against attacks and breaches are bypassed entirely by these attacks.
A Pattern, Not an Anomaly
The ongoing active exploitation of this vulnerability in the wild is not just one problem that can be fixed by applying the patch released in May. Rather, it is just one example of a much broader issue. “When I analyzed CISA's Known Exploited Vulnerabilities (KEV) catalog in July, security and network infrastructure vendors accounted for over a quarter of actively exploited entries in the first half of 2026, with 75 entries flagged as ransomware entry points and Palo Alto Networks holding 6 of them,” says Jacob Krell, Senior Director of Secure AI Solutions & Cybersecurity at Suzu Labs.
Why the Patch Didn't Close the Gap
The glaring issue underscoring any examination of the ongoing attacks exploiting CVE-2026-0257 is that active exploitation is surviving past Palo Alto Networks releasing a patch for it. The fix came out soon after the vulnerability was discovered, but there is always a gap between when a patch is released and when it is actually applied by users and organizations. Many let their systems go unpatched, leaving them open to exploitation of a patched flaw.
Compromises that occurred prior to the fix being released may also survive the software being updated. Attackers who have established a foothold within an organization’s systems and achieved lateral movement are not removed just because the door they used to get in has been closed. Attackers are also increasingly relying on AI-accelerated vulnerability discovery, further shrinking the window of time between disclosure and exploitation.
Beyond Patching
While applying the patch released by Palo Alto Networks is necessary to protect against these attacks, it is not sufficient on its own to remediate the damage or mitigate the risk of similar threats in the future. Organizations must not only patch the affected software, but hunt within their systems and networks for signs of prior compromise.
To account for risks like this moving forward, it is crucial to treat the firewall as an endpoint that is accessible to adversaries, not an impenetrable wall. Organizations are encouraged to segment their networks so that a single compromised gateway does not provide attackers access to everything within. Continuous offensive testing should be carried out with verified remediation.
The Perimeter Device Providing Entry
It is important to see the attacks exploiting this vulnerability as an indicator of where security may be falling short. Many users and organizations place implicit trust in edge appliances and fail to adequately secure them against attacks as a consequence. Validation should be carried out across the architecture, not just in individual controls that attackers may be able to bypass. Ultimately, the real measure of success against threats like this often comes down to the speed at which a vulnerability can be fixed matching the pace of AI-accelerated discovery.
