Palo Alto Networks' Unit 42 team said on October 19 that ransomware groups are still trying to exploit CVE-2026-0257, a flaw in PAN-OS, the software on its firewalls. It named Spikey Scorpius (also called Qilin) and Tarnished Scorpius (also called Inc). It added that public reports link the attacks to users of Settra ransomware. The flaw lets attackers skip the login check on GlobalProtect, the company's VPN, and open a VPN connection. Unit 42 said the US cyber agency CISA added the flaw to its known-exploited list on May 13, 2026. Unit 42 has investigated since early June, across many industries.
Unit 42 described one case in which attackers went from the VPN to a vCenter server, which manages virtual machines. They switched off a security setting on ESXi hosts and used a custom tool to copy passwords from a domain controller's virtual disk. Unit 42 said this avoids security tools running inside the machine. It also saw attackers pair the flaw with an older Veeam backup bug, CVE-2023-27532. The brief says only a small share of probed devices made VPN sessions. It does not give a victim count, and it does not name the fixed versions.
Teams that run GlobalProtect face a login flaw that attackers have used to reach virtual servers and backup software. Unit 42 advises checking the Palo Alto advisory, applying its workarounds or upgrading, and searching GlobalProtect logs for the listed signs.