21 OCT 2026 — Two ransomware operations are now using a five-month-old flaw in Palo Alto Networks' GlobalProtect VPN to get inside corporate networks, the company's threat research unit says. In an update to its threat brief on CVE-2026-0257, dated 19 October, Unit 42 names the groups it tracks as Spikey Scorpius, also known as Qilin, and Tarnished Scorpius, also known as Inc. A further update on 20 October added guidance on a firewall misconfiguration that exposes management interfaces to the internet.
Palo Alto published its advisory in May. What has changed is who is using it and what they do once they are in.
From probing to ransomware
When Unit 42 first wrote about the bug, it described "an unidentified threat actor" trying to reach GlobalProtect, and said no post-access behaviour or lateral movement had been seen. Only a small share of the devices probed went on to set up a VPN session. That early text is still on the page, above the new material.
The October update describes a different picture. According to Unit 42, attackers use the flaw for a first foothold, get past multi-factor authentication (MFA) to open a VPN session, then map the internal network with dual-use remote monitoring and management tools. They move between machines over RDP and SMB, and stage further tools for stealing credentials, taking data out and, finally, deploying ransomware.
Unit 42 says its investigations have run since early June 2026 and span numerous industries, with 11 sectors listed including education, financial services, healthcare, government, and utilities and energy. It names no victims, and RECATOOLS has not identified any.
What the flaw does
Palo Alto's security advisory describes authentication bypass weaknesses in the GlobalProtect portal and gateway of PAN-OS that let an attacker set up an unauthorised VPN connection. It files the weakness under CWE-565, the class for cookies a system trusts without checking that they are valid or untampered. Exposure depends on configuration: a firewall is affected only when authentication override cookies are switched on and a particular certificate setup exists. Panorama and Cloud NGFW are not affected.
Fixed builds exist for PAN-OS 10.2, 11.1, 11.2 and 12.1, and Palo Alto says Prisma Access is being upgraded on a schedule shared with customers. Where patching must wait, the company suggests two mitigations. One is to give authentication override cookies their own certificate, not reused by the portal, the gateway or anything else. The other is to switch authentication override off. After the upgrade, GlobalProtect users have to log in again once, because the cookie is regenerated by a more secure method.
The rating has moved. Rapid7, which reported in-the-wild exploitation in May, wrote that the CVSS 4.0 score went from 4.7 to 7.8 on 29 May. Its earliest observed exploitation was 17 May. The advisory explains that its severity follows a threat score, which rises when exploit code is published or attacks are seen.
Straight to the hypervisor
The detail Unit 42 singles out is a jump to the virtualisation layer. In one case, attackers went from the compromised VPN gateway to a VMware vCenter management appliance. From there they turned off a security control on ESXi hosts (execInstalledOnly) and used a custom tool to dump credentials offline from a domain controller's virtual disk.
Working on the disk file sidesteps endpoint detection and response software running inside the guest machine. Unit 42 calls it "a highly sophisticated method for obtaining domain-wide credentials". It has also seen attackers pair this access with exploits for Veeam backup servers, such as CVE-2023-27532.
A link first made in July
Qilin's use of this bug is not new information. Arctic Wolf Labs published an analysis on 20 July of several June intrusions that began with CVE-2026-0257 and ended in Qilin encryption. It saw attackers dump LSASS memory and extract the domain's NTDS database. Because the follow-up work varied from encryption alone to double extortion, Arctic Wolf suggested more than one Qilin affiliate could be involved.
What Unit 42 adds is a second group, Inc, and its own case data. It also points to public reporting that ties exploitation to actors using Settra ransomware. Cybersecurity Dive reported that ReliaQuest flagged Qilin and Settra activity on 9 October. "About five months after disclosure, the flaw has become a reliable way into networks for ransomware groups, and that will likely continue over the next three months as more groups and access brokers adopt it," Brandon Tirado, a vice president at ReliaQuest, told the outlet.
The US Cybersecurity and Infrastructure Security Agency's catalogue of exploited vulnerabilities now marks ransomware use of the flaw as "Known". CISA set 1 June as the due date for remediation.
What defenders should check
Patching closes the hole but does not remove anyone already inside. Unit 42 asks organisations to check GlobalProtect logs for gateway-connected events that succeeded from nine listed IP addresses, and from any address presenting placeholder device details such as the MAC address aa:bb:cc:dd:ee:ff or the host name GP-CLIENT. Any match should go to incident response.
The 20 October addition concerns a separate mistake found during earlier incident work. Some organisations map GlobalProtect profiles to HTTP or HTTPS services on the firewall's management interface, which can expose that interface to the internet on ports 4443 and 3879, often without administrators realising. Unit 42 suggests testing from outside by trying an HTTPS connection to the management IP on those ports, then restricting access through Interface Management profiles.
For teams that have patched, the remaining question is whether anyone got in before then. Rapid7 dates the first exploitation to four days after the advisory appeared, and the ransomware activity Unit 42 describes began in June.
View author profile → · Editorial policy
