Ransomware Operators Exploit PAN-OS GlobalProtect Authentication Bypass
Summary
Unit 42 reports active exploitation of PAN-OS CVE-2026-0257 by ransomware operators, with some attackers pivoting from VPN gateways to virtualization systems. It advises checking GlobalProtect logs and applying mitigations or upgrades.
Key points
- CVE-2026-0257 is an authentication bypass in PAN-OS portal and gateway components that can let attackers initiate GlobalProtect VPN connections.
- Unit 42 observed exploitation by ransomware operators it identifies as Spikey Scorpius (Qilin) and Tarnished Scorpius (Inc); public reporting also attributes activity to actors using Settra ransomware.
- In observed intrusions, attackers used the VPN access for reconnaissance, lateral movement, credential harvesting, data exfiltration and ransomware deployment.
- In one case, attackers pivoted from a compromised VPN gateway to vCenter, disabled an ESXi security control and used a custom tool to extract credentials offline from a domain controller’s virtual disk.
- Unit 42 recommends searching GlobalProtect logs for successful gateway connections matching the listed IP addresses, suspicious host IDs or device names, and specified client configuration values.
- Organizations are advised to follow the CVE-2026-0257 advisory, apply available workarounds and mitigations, or upgrade to a fixed version.
Article Details
- Vulnerability Types
- Authentication bypass in the PAN-OS portal and gateway components
- Exploitation Status
- active
- Exploit Availability
- public_poc
- Patch Status
- available
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 104[.]207[.]144[.]154 | IP address Unit 42 associates with pre-PoC exploitation activity; search GlobalProtect logs for successful connections. |
| IPV4 | 146[.]19[.]216[.]119 | IP address Unit 42 associates with pre-PoC exploitation activity; search GlobalProtect logs for successful connections. |
| IPV4 | 146[.]19[.]216[.]120 | IP address Unit 42 associates with pre-PoC exploitation activity; search GlobalProtect logs for successful connections. |
| IPV4 | 146[.]19[.]216[.]125 | IP address Unit 42 associates with pre-PoC exploitation activity; search GlobalProtect logs for successful connections. |
| IPV4 | 179[.]43[.]172[.]213 | IP address Unit 42 associates with pre-PoC exploitation activity; search GlobalProtect logs for successful connections. |
| IPV4 | 185[.]195[.]232[.]139 | IP address Unit 42 associates with pre-PoC exploitation activity; search GlobalProtect logs for successful connections. |
| IPV4 | 198[.]12[.]106[.]60 | IP address Unit 42 associates with pre-PoC exploitation activity; search GlobalProtect logs for successful connections. |
| IPV4 | 202[.]144[.]192[.]47 | IP address Unit 42 associates with pre-PoC exploitation activity; search GlobalProtect logs for successful connections. |
| IPV4 | 23[.]128[.]228[.]6 | IP address Unit 42 associates with pre-PoC exploitation activity; search GlobalProtect logs for successful connections. |
MITRE ATT&CK
T1003 · OS Credential DumpingAttackers used a custom tool to perform offline credential dumping against a domain controller's virtual disk.T1021.001 · Remote Desktop ProtocolThe article reports lateral movement via RDP.T1021.002 · SMB/Windows Admin SharesThe article reports lateral movement via SMB.T1046 · Network Service DiscoveryAfter exploitation, attackers conduct internal network reconnaissance.T1190 · Exploit Public-Facing ApplicationAttackers exploit the PAN-OS GlobalProtect authentication bypass to gain an initial foothold through the exposed gateway.T1562.001 · Disable or Modify ToolsIn a reported case, attackers disabled the execInstalledOnly security control on ESXi hypervisors.
CVE
CVE-2023-27532We have also observed actors chaining this initial access with other exploit tools, such as those targeting Veeam backup infrastructure (CVE-2023-27532), to maximize their impact.CVE-2026-0257October 19 Update: Unit 42 continues to observe attempted exploitation of CVE-2026-0257 by ransomware operators including Spikey Scorpius (aka Qilin) and Tarnished Scorpius (aka Inc).
Threat Actors
Malware
Vendors
Palo Alto NetworksPalo Alto Networks Unit 42 has observed active exploitation of PAN-OS vulnerability CVE-2026-0257 by an unidentified threat actor attempting to access GlobalProtect.VeeamWe have also observed actors chaining this initial access with other exploit tools, such as those targeting Veeam backup infrastructure (CVE-2023-27532), to maximize their impact.
Products
ESXiFrom there, they disabled security controls on ESXi hypervisors (execInstalledOnly) and used a custom tool to perform offline credential dumping directly against a domain controller's virtual disk (VMDK).GlobalProtectPalo Alto Networks Unit 42 has observed active exploitation of PAN-OS vulnerability CVE-2026-0257 by an unidentified threat actor attempting to access GlobalProtect.PAN-OSPalo Alto Networks Unit 42 has observed active exploitation of PAN-OS vulnerability CVE-2026-0257 by an unidentified threat actor attempting to access GlobalProtect.VMware vCenter ServerIn one notable case, attackers moved from the compromised VPN gateway to the vCenter management appliance.