Reports from Palo Alto Networks indicate ongoing exploitation of a recently patched security vulnerability affecting PAN-OS and Prisma Access by ransomware groups.
The vulnerability in question is CVE-2026-0257 (CVSS score: 7.8), which allows for an authentication bypass that enables unauthorized VPN connections. This flaw was addressed by Palo Alto Networks in May 2026 and was listed in the U.S. Cybersecurity and Infrastructure Security Agency’s (CSIA) Known Exploited Vulnerabilities (KEV) catalog on May 13, 2026.
Recent updates from Unit 42 researchers reveal that ransomware operators such as Spikey Scorpius (Qilin) and Tarnished Scorpius (INC) are actively exploiting CVE-2026-0257. This activity has been detected in financially-motivated attacks, with groups like Qilin and Settra leveraging the vulnerability to infiltrate corporate networks.
These threat actors are leveraging the vulnerability to gain initial access to networks and bypass multi-factor authentication controls to establish VPN sessions.
Once inside, the attackers conduct internal network reconnaissance using remote monitoring tools, move laterally across networks via RDP and SMB, and deploy additional tools for credential harvesting, data exfiltration, and ransomware deployment.
Attacks by these groups have targeted various sectors, including education, financial services, healthcare, technology, hospitality, manufacturing, legal services, government, transportation, utilities, and retail.
One significant change in tactics following exploitation of CVE-2026-0257 is the pivot to the virtualization layer, with attackers moving from compromised VPN gateways to vCenter management appliances to obtain domain-wide credentials.
Furthermore, attackers have been observed chaining the initial access method with other exploit tools, including targeting Veeam backup infrastructure through known vulnerabilities (CVE-2023-27532) for maximum impact.
Organizations are advised to apply the latest patches and actively search for indicators of compromise while implementing incident response procedures if gateway-connected events are detected.
