PAN-OS CVE-2026-0257 now feeds Qilin and Inc ransomware, and Unit 42 traces one intrusion to vCenter

CVE-2026-0257 is not new. Palo Alto Networks published the advisory on May 13, 2026, and a public proof of concept followed on May 29. What changed on October 19 is who is using it. Unit 42's updated threat brief now names two ransomware operations exploiting the flaw, Spikey Scorpius (Qilin) and Tarnished Scorpius (Inc), and describes intrusions that go from the GlobalProtect gateway to the virtualization layer.

For a firewall team that deferred this patch in June, that is the reason to stop deferring.

The flaw, and the configuration it needs

The advisory describes GlobalProtect authentication bypass issues that "allow the attacker to bypass security restrictions and establish an unauthorized VPN connection." It is scored 7.8 under CVSS 4.0, with a threat intelligence rating of ATTACKED. Panorama and Cloud NGFW are not affected.

Exposure is narrower than "every GlobalProtect box." The advisory says the issue affects firewalls "with GlobalProtect portal or gateway configured when authentication override cookies are enabled and a specific certificate configuration exists." In practice that means the portal's "Generate cookie for authentication override" or "Accept cookie for authentication override" options, or the gateway's "Accept cookie for authentication override" option, combined with a certificate shared with other features.

Fixed releases, per the advisory:

One operational note from the advisory: GlobalProtect users must re-authenticate once after the upgrade, even with a valid cookie.

What the October update adds

Unit 42 says its investigations began in early June and span sectors from education and healthcare to government and utilities. The pattern it now describes: initial access through CVE-2026-0257, an MFA bypass to establish a VPN session, then reconnaissance with dual-use remote management tools, lateral movement over RDP and SMB, and staging for credential theft, exfiltration and ransomware.

The most significant shift is below the operating systems. In one case, Unit 42 says, "attackers moved from the compromised VPN gateway to the vCenter management appliance," disabled security controls on ESXi hosts and dumped credentials offline from a domain controller's virtual disk. Unit 42's assessment of that technique: "This tactic bypasses in-guest endpoint detection and response (EDR) and security controls." Attackers have also chained the access with exploitation of Veeam backup infrastructure through CVE-2023-27532.

Contrast that with the brief's earlier finding that "Only a small portion of the probed devices actually established VPN sessions." The share of successful attempts may still be small. What happens after a success is no longer reconnaissance.

What to do

• Upgrade to a fixed release for your branch. If you can't yet, the advisory's workarounds are to use a dedicated certificate only for authentication override cookies, or to disable the override cookie options on the portal and gateway.
• Hunt in GlobalProtect logs. Unit 42 lists source IPs for pre-PoC activity, and hard-coded client values from the public PoC (host IDs such as aa:bb:cc:dd:ee:ff, device names such as GP-CLIENT, an endpoint_os_version of "Microsoft Windows 10 Pro 64-bit" with an empty domain) to search across successful gateway-connected events from any IP.
• If any match, Unit 42 says to activate incident response, and given the October findings, the scope should include vCenter, ESXi and backup servers, not just Windows endpoints.

Primary sources: Palo Alto Networks advisory CVE-2026-0257, Unit 42 threat brief: Active Exploitation of PAN-OS CVE-2026-0257, read 2026-10-20.