PAN-OS CVE-2026-0257 Exploited by Qilin and Inc Ransomware

Executive Summary

A critical vulnerability in Palo Alto Networks' PAN-OS software, tracked as CVE-2026-0257, is under active exploitation by multiple ransomware groups, including Spikey Scorpius (aka Qilin) and Tarnished Scorpius (aka Inc). The vulnerability is an authentication bypass in the GlobalProtect portal and gateway components, allowing an unauthenticated attacker to establish a VPN session and gain a foothold within a target network. This flaw effectively bypasses Multi-Factor Authentication (MFA) controls tied to the VPN.

The threat has been elevated by the adoption of sophisticated post-exploitation techniques. Attackers are not merely gaining access but are pivoting directly to the virtualization layer, specifically targeting VMware vCenter and ESXi hosts. They have been observed disabling hypervisor security controls and using custom tools to extract domain credentials directly from a domain controller's virtual disk (.vmdk file). This offline attack method is highly evasive and bypasses most in-guest security solutions like EDR. Given the active exploitation and high impact, organizations using vulnerable versions of PAN-OS must apply patches or mitigations immediately.

Vulnerability Details

CVE-2026-0257 is an authentication bypass vulnerability affecting the GlobalProtect portal and gateway components of vulnerable Palo Alto Networks PAN-OS software. The flaw allows an unauthenticated, remote attacker to connect to the gateway and establish a VPN session. The root cause lies in an improper validation of user credentials, enabling an attacker to circumvent security controls.

• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None

The vulnerability was added to the CISA Known Exploited Vulnerabilities (KEV) catalog on May 13, 2026, indicating its use in real-world attacks. Public proof-of-concept (PoC) code became available around May 29, 2026, further lowering the bar for exploitation.

Threat Overview

Multiple threat actors are exploiting CVE-2026-0257 for initial access into corporate networks. Confirmed operators include:

• Spikey Scorpius, the group behind Qilin ransomware.
• Tarnished Scorpius, the group behind Inc ransomware.
• Unnamed actors deploying Settra ransomware have also been publicly associated with exploiting this flaw.

The primary goal is to establish a persistent presence on the target network, which serves as a launchpad for data exfiltration and ransomware deployment. The attackers' ability to bypass MFA makes this an especially potent initial access vector.

Technical Analysis

The most concerning development in the exploitation of CVE-2026-0257 is the evolution of the attackers' post-exploitation tactics, techniques, and procedures (TTPs). After gaining initial access via the compromised VPN gateway, threat actors are making a direct pivot to the organization's virtualization infrastructure.

In one observed attack chain:

1. Initial Access: The attacker exploits CVE-2026-0257 to establish a VPN session (T1133 - External Remote Services).
2. Discovery & Lateral Movement: The attacker moves from the VPN appliance to the VMware vCenter management server.
3. Defense Evasion: On the VMware ESXi hypervisor, the attacker disables the execInstalledOnly security setting. This control normally prevents the execution of unsigned or non-standard code, and disabling it allows the attacker to run custom tools (T1562.001 - Disable or Modify Tools).
4. Credential Access: The attacker uses a custom tool to perform offline credential dumping by directly accessing the domain controller's virtual disk file (.vmdk). This allows them to extract the NTDS.dit file, containing all Active Directory domain credentials, without ever logging into the domain controller's guest OS (T1003.003 - OS Credential Dumping: NTDS).

This TTP is highly effective because it bypasses security controls operating within the guest operating system, such as Endpoint Detection and Response (EDR) agents. Attackers have also been observed chaining this access with other exploits, such as CVE-2023-27532 in Veeam backup software, to further their objectives.

MITRE ATT&CK Techniques Observed

• T1190 - Exploit Public-Facing Application
• T1133 - External Remote Services
• T1562.001 - Disable or Modify Tools
• T1003.003 - OS Credential Dumping: NTDS
• T1552.001 - Credentials In Files

Impact Assessment

The exploitation of CVE-2026-0257 poses a severe risk to organizations. The direct impact includes a full bypass of perimeter defenses, including MFA, leading to unauthorized network access. The sophisticated post-exploitation TTPs targeting the virtualization layer significantly amplify the potential damage. By obtaining domain-wide credentials through offline methods, attackers can achieve complete control over the Active Directory environment, leading to:

• Mass deployment of ransomware across the enterprise.
• Large-scale data exfiltration and double-extortion tactics.
• Complete compromise of business operations.
• Significant financial and reputational damage.

Bypassing EDR and other in-guest security tools means that traditional endpoint monitoring may fail to detect the most critical phase of the attack, allowing the compromise to go unnoticed until it is too late.

IOCs — Directly from Articles

No specific IP addresses, domains, or file hashes were provided in the source article.

Cyber Observables — Hunting Hints

Security teams may want to hunt for the following patterns to detect potential exploitation or post-exploitation activity:

Detection & Response

Defenders should implement multi-layered detection strategies:

1. Network Log Analysis (D3-NTA: Network Traffic Analysis): Ingest GlobalProtect logs into a SIEM. Create alerts for successful gateway-connected events from untrusted IP ranges or those with suspicious device/host IDs. Baseline normal VPN connection patterns and alert on deviations.
2. Virtualization Layer Monitoring: Forward logs from vCenter and ESXi hosts to a centralized SIEM. Monitor for authentication anomalies, security configuration changes (like disabling execInstalledOnly), and direct access to VMDK files. Changes to hypervisor settings should be considered highly suspicious and trigger an immediate alert.
3. Endpoint and Process Monitoring (D3-PA: Process Analysis): While the attack bypasses in-guest EDR for credential theft, EDR is still crucial for detecting subsequent lateral movement and malware execution on other endpoints. Monitor for unusual processes spawned by VPN-connected sessions.
4. Incident Response: If a successful connection from a suspicious IP is found, assume compromise. Immediately activate incident response protocols. Isolate the affected VPN gateway and any systems the attacker may have accessed. Begin a forensic investigation on the vCenter and ESXi hosts for signs of tampering or custom tool execution.

Mitigation

Immediate action is required to mitigate this threat.

1. Patch Immediately (D3-SU: Software Update): The primary mitigation is to upgrade to a patched version of PAN-OS software. Refer to the Palo Alto Networks security advisory for CVE-2026-0257 for a list of fixed versions.
2. Apply Workarounds: If patching is not immediately possible, apply the mitigations and workarounds recommended by Palo Alto Networks. This may involve specific configuration changes to restrict access.
3. Network Segmentation (D3-NI: Network Isolation): Implement strict network segmentation rules to prevent systems in the VPN user segment from communicating with critical infrastructure management interfaces, such as vCenter and ESXi management networks. This is a critical compensating control.
4. Harden Virtualization Infrastructure: Restrict administrative access to vCenter and ESXi hosts to a limited set of privileged workstations. Enforce MFA for all vCenter logins. Regularly audit permissions and configurations.
5. Enable Threat Prevention Signatures: Palo Alto Networks customers should ensure that relevant Threat Prevention signatures, Advanced URL Filtering, and Advanced IP Defense protections are enabled and up to date.