What changed. Palo Alto Networks’ Unit 42 updated its threat brief on CVE-2026-0257 on Monday, Oct 19, at 4:00 PM PT. The new line: ransomware operators are now exploiting it, specifically Spikey Scorpius (Qilin) and Tarnished Scorpius (INC). Unit 42 also points to public reporting that tied exploitation to actors using Settra ransomware. The flaw is an authentication bypass in the GlobalProtect portal and gateway of PAN-OS and Prisma Access. It lets an attacker establish a VPN connection without valid credentials. Palo Alto published the advisory and the first fixes on May 13, 2026. CISA added it to the KEV catalog on May 29, with a June 1 deadline for federal agencies, and lists it as known to be used in ransomware campaigns. So this is not a new bug. What’s new is who is using it and what they do after they get in.
How the intrusions run. Per Unit 42, the crews use the bypass to get a foothold and an MFA-free VPN session. Then they do recon with dual-use RMM tools, move laterally over RDP and SMB, and stage tooling for credential harvesting, exfiltration and finally ransomware. The part defenders should sit up for: in one case the attackers went from the VPN gateway to the vCenter management appliance, disabled execInstalledOnly on the ESXi hosts, and used a custom tool to dump credentials offline from a domain controller’s VMDK. That gets them domain-wide credentials without ever running code inside the guest, which is where your EDR lives. Unit 42 also saw the access chained with exploits for Veeam Backup & Replication (CVE-2023-27532), which is the usual move before encryption: take out the backups first.
Who’s exposed. According to Palo Alto’s advisory, the issue affects GlobalProtect portals or gateways that have authentication override cookies enabled along with a specific certificate configuration. Fixed builds include PAN-OS 12.1.7, 11.2.12, 11.1.15 and 10.2.18-h6, plus hotfix trains on each branch. Prisma Access tenants are being upgraded on Palo Alto’s schedule, but hybrid deployments still need their on-prem firewalls patched. Cloud NGFW and Panorama are not affected. Unit 42 says its investigations have been running since early June and cover education, finance, healthcare, high tech, hospitality, manufacturing, legal and professional services, government, transportation, utilities and retail. Victim names and count: Undisclosed. Arctic Wolf flagged Qilin using the bug back in July (per The Hacker News), so for some orgs the timeline is already months long.
The buyer and analyst read. Five months after the fix, ransomware crews are still finding enough unpatched GlobalProtect gateways to make this worthwhile. That says more about how slowly edge devices get patched than about Palo Alto’s code. It is the same pattern as this month’s Ivanti Connect Secure and Fortinet items. Still, Prisma Access is the SASE line Palo Alto points to when it talks up Next-Gen Security ARR, and a known-exploited, MFA-skipping remote-access bug in active ransomware use is the kind of thing a Zscaler or Cloudflare rep brings to a renewal meeting. Our view: the bigger story for CISOs is the hypervisor pivot. If a stolen VPN session can reach vCenter, your EDR coverage doesn’t matter much.
What we’d check this morning. Confirm that every GlobalProtect portal and gateway, internal and external, is on a fixed build. Palo Alto says they have to be upgraded together if you use override cookies. If you can’t patch today, disable authentication override or move it to a dedicated certificate that nothing else uses. Search GlobalProtect logs for successful gateway-connected events from the Unit 42 IP list. Also look for placeholder host IDs or device names such as aa:bb:cc:dd:ee:ff, 00:11:22:33:44:55, WINDOWS-LAPTOP-001, DESKTOP-GP01 and GP-CLIENT, and for the PoC fingerprint of “Microsoft Windows 10 Pro 64-bit” with an empty user domain. Treat any hit as an incident.
Our advice, beyond Unit 42’s list. Unit 42 describes the vCenter pivot but doesn’t prescribe these steps; they’re ours. Take vCenter off any network VPN users can reach, confirm execInstalledOnly is still enforced on every ESXi host, and patch or isolate Veeam.