Ransomware Crews Keep Abusing a Patched PAN-OS Authentication Bypass
Palo Alto Networks has disclosed that it continues to see exploitation of a patched flaw in PAN-OS and Prisma Access by ransomware actors. The bug, CVE-2026-0257 (CVSS 7.8), is an authentication bypass. It was patched in May 2026 and added to CISA's KEV catalog on May 13, 2026.
Who Is Exploiting It
- Qilin (tracked by Palo Alto as Spikey Scorpius)
- INC (tracked as Tarnished Scorpius)
- ReliaQuest separately reported Qilin and Settra ransomware using the flaw
- Arctic Wolf flagged Qilin using it in July 2026
Observed intrusions range from encryption-only attacks to full double extortion.
Attack Chain
- Exploit the flaw for initial access and bypass MFA to establish a VPN session.
- Run internal reconnaissance with dual-use RMM tools.
- Move laterally over RDP and SMB.
- Stage tools for credential harvesting, data exfiltration and ransomware deployment.
In one case the attackers pivoted from the VPN gateway to a vCenter appliance and disabled security controls on ESXi hosts. They then used a custom tool to dump credentials offline from a domain controller's VMDK, which avoids in-guest EDR. Access was also chained with CVE-2023-27532, a Veeam backup flaw, to maximize damage.
Targeted Sectors
Education, financial services, healthcare, high technology, hospitality, manufacturing, professional and legal services, government, transportation and logistics, utilities and energy, and retail.
Recommended Actions
- Apply the latest Palo Alto Networks fixes for PAN-OS and Prisma Access.
- Hunt proactively for indicators of compromise; see the Unit 42 advisory for specifics.
- Start incident response if you find successful gateway-connected events from unexpected sources.
- Restrict access to vCenter and ESXi management, and patch Veeam (CVE-2023-27532).
- Monitor for unauthorized RMM tools.
Source: The Hacker News.