Skip to content

Back to the catalog

Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257 (Updated Oct 20)
unit42.paloaltonetworks.comadvisory

Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257 (Updated Oct 20)

Unit 42 threat brief on active exploitation of CVE-2026-0257, a PAN-OS GlobalProtect authentication bypass added to CISA KEV on May 13, 2026. It lists IP addresses, host IDs and PoC-derived client values to hunt in GlobalProtect logs. The October 2026 updates cover Qilin and Inc ransomware operators, MFA bypass, pivots to vCenter and ESXi with offline VMDK credential dumping, and management interface exposure on ports 4443 and 3879.

TL;DR Unit 42 tracks exploitation of the PAN-OS GlobalProtect auth bypass CVE-2026-0257, with IOCs, hunting tips and ransomware tradecraft through October 2026.
Open original ↗
Document

What it is

Unit 42's threat brief on CVE-2026-0257, an authentication bypass in the portal and gateway components of PAN-OS GlobalProtect. CISA added it to the KEV catalog on May 13, 2026. The page was updated on June 9, October 19 and October 20, 2026. The October 19 update names Spikey Scorpius (Qilin) and Tarnished Scorpius (Inc) as ransomware operators exploiting it. The page also cites public reporting that links Settra ransomware to the flaw. The page gives no affected version ranges and no fixed version numbers. It refers readers to the Palo Alto Networks advisory for those.

How it works

Attackers use the bypass to open VPN sessions and get a foothold. They then bypass MFA to establish the VPN session. Next they run internal reconnaissance with dual-use RMM tools, move laterally over RDP and SMB, and stage tooling for credential harvesting, exfiltration and ransomware.

The notable change is a pivot to the virtualization layer. In one case the attackers went from the VPN gateway to the vCenter appliance and disabled the ESXi execInstalledOnly control. They then used a custom tool to dump credentials offline from a domain controller's VMDK. This bypasses in-guest EDR. Some actors also chained the access with exploits for Veeam (CVE-2023-27532).

Unit 42's investigations began in early June 2026. They span education, financial services, healthcare, high technology, hospitality, manufacturing, professional and legal services, government, transportation and logistics, utilities and energy, and wholesale and retail.

Preconditions / Affected

A vulnerable PAN-OS version with GlobalProtect portal or gateway exposed. Separately, in Lunar Peak incident response work, Unit 42 often found GlobalProtect profiles mapped to HTTP/HTTPS services on management interfaces. That exposes the management interface to the internet on ports 4443 and 3879, often without the administrator's knowledge.

What to do

  • Search GlobalProtect logs for successful gateway-connected events from these IPs (pre-PoC activity, before May 29, 2026): 23.128.228[.]6, 104.207.144[.]154, 146.19.216[.]119, 146.19.216[.]120, 146.19.216[.]125, 179.43.172[.]213, 185.195.232[.]139, 198.12.106[.]60, 202.144.192[.]47.
  • Search for gateway-connected events from any IP using these host IDs or device names: aa:bb:cc:dd:ee:ff, 00:11:22:33:44:55, WINDOWS-LAPTOP-001, DESKTOP-GP01, GP-CLIENT.
  • For post-PoC activity, match the hard-coded PoC client values: endpoint_os_version of Microsoft Windows 10 Pro 64-bit and an empty source_user_info.domain.
  • Treat any successful gateway-connected event tied to these indicators as an incident and start incident response.
  • Apply the workarounds in the Palo Alto Networks advisory or upgrade to a fixed version.
  • Check management exposure by opening an HTTPS connection to the management IP on ports 4443 and 3879 from an external browser.
  • If those ports answer, restrict access with Interface Management profiles, following the Palo Alto Networks documentation.
  • Given the vCenter and ESXi pivot, review hypervisor controls and vCenter access after any gateway compromise. Also check Veeam for CVE-2023-27532.

Caveats

The original brief said no post-access behavior had been seen and that only a small share of probed devices formed VPN sessions. The October update supersedes that. The host ID list is "including but not limited to", so absence of a match is not clearance. The PoC-derived client values apply only to activity that reuses the PoC code. The Settra attribution is public reporting, not a Unit 42 finding. The vCenter and VMDK pivot is described as one notable case. The page does not say how the MFA bypass works. The product protection section is vendor-specific.

Organisations named here

  • execInstalledOnly
  • Inc
  • Lunar Peak
  • MFA bypass
  • Settra
  • Spikey Scorpius
  • Tarnished Scorpius

CVEs named here

  • CVE-2023-27532
  • CVE-2026-0257

Technologies named here

  • Palo Alto Networks Cortex Xpanse
  • Advanced URL Filtering and Advanced IP Defense
  • VMware vCenter management appliance and ESXi hypervisors
  • Cortex AgentiX Threat Intel agent
  • Veeam backup infrastructure
  • Cortex XDR and XSIAM
  • Unit 42 Incident Response team
  • Dual-use remote monitoring and management tools
  • Cyber Threat Alliance
  • VPN
  • VMware vCenter
  • Veeam
  • CISA KEV
  • Rapid7
  • Unit 42
  • ESXi
  • GlobalProtect
  • PAN-OS

Techniques named here

  • Internal network reconnaissance using dual-use RMM tools
  • Lateral movement via RDP and SMB
  • Disabling ESXi security controls
  • Chaining initial access with exploit tools targeting Veeam
  • Indicator IPs
  • Indicator host IDs and names

Threat actors named here

  • Spikey Scorpius
  • Tarnished Scorpius
  • Settra ransomware
  • Unidentified threat actor
  • Lunar Peak campaign
  • Qilin

Related in Threat Intel