Palo Alto Networks has disclosed that it’s continuing to observe exploitation of a now-patched security flaw impacting PAN-OS and Prisma Access by ransomware actors.
The activity relates to CVE-2026-0257 (CVSS score: 7.8), an authentication bypass flaw that could be exploited by bad actors to set up unauthorized VPN connections. It was patched by Palo Alto Networks in May 2026 and was added by the U.S. Cybersecurity and Infrastructure Security Agency (CSIA) to its Known Exploited Vulnerabilities (KEV) catalog on May 13, 2026.
“Ransomware operators exploiting CVE-2026-0257 include Spikey Scorpius (aka Qilin) and Tarnished Scorpius (aka INC),” Unit 42 researchers said in an update shared on Monday. The development comes days after ReliaQuest said it detected both Qilin and Settra ransomware groups actively exploiting the flaw in financially-motivated attacks.
According to Unit 42, the threat actors are weaponizing the flaw to gain an initial foothold into corporate networks, and then bypass multi-factor authentication (MFA) controls to establish a VPN session.
Upon setting up a VPN session, the attackers have been found to engage in the following post-compromise activity –
- Conduct internal network reconnaissance using dual-use remote monitoring and management (RMM) tools.
- Move laterally across the network via RDP and SMB.
- Stage additional tooling for credential harvesting, data exfiltration, and ransomware deployment.
Attacks mounted by these groups are said to have targeted a wide range of sectors, including education, financial services, healthcare, high technology, hospitality, manufacturing, professional and legal services, government, transportation and logistics, utilities and energy, and retail.
“The most significant evolution in tactics, techniques and procedures (TTPs) following successful exploitation of CVE-2026-0257 is the direct pivot to the virtualization layer,” Unit 42 said.
“In one notable case, attackers moved from the compromised VPN gateway to the vCenter management appliance. From there, they disabled security controls on ESXi hypervisors (execInstalledOnly) and used a custom tool to perform offline credential dumping directly against a domain controller’s virtual disk (VMDK).”
This approach, the network security vendor added, circumvents in-guest endpoint detection and response (EDR) and security protections, allowing the threat actors to obtain domain-wide credentials.
Attackers have also been observed chaining the initial access method with other exploit tools, including efforts to target Veeam backup infrastructure by abusing known flaws (CVE-2023-27532) to inflict maximum damage.
It’s worth noting that Qilin’s exploitation of CVE-2026-0257 was previously flagged by Arctic Wolf in July 2026, with attacks ranging from rapid encryption-only operations to full double-extortion.
Besides applying the latest fixes, Palo Alto Networks is recommending that organizations proactively hunt for indicators of compromise and initiate appropriate incident response protocols if successful gateway-connected events are detected.
