- Palo Alto Networks' Unit 42 says ransomware operators have attempted to exploit CVE-2026-0257, a PAN-OS GlobalProtect login bypass. It separately describes one case that reached vCenter and ESXi.
- Unit 42 says the hypervisor step bypasses endpoint detection tools running inside the servers. It links that case to no named group.
- Leaders should confirm the PAN-OS fix, search GlobalProtect logs for Unit 42's indicators, and check who can reach vCenter.
A VPN login is only the first door
A VPN login is a checkpoint. When it fails, the question is what the visitor can reach next. Palo Alto Networks' Unit 42 has published part of that answer from its own investigations.
Unit 42 reports active exploitation of CVE-2026-0257. The bug sits in the login portal and gateway of GlobalProtect, the VPN feature in PAN-OS firewall software. It lets attackers skip checks and start VPN connections they should not get.
What Unit 42 reports
CISA added the flaw to its Known Exploited Vulnerabilities catalog on May 13, 2026. Unit 42 dates a public proof-of-concept release to May 29. Its own investigations began in early June 2026 and cover many industries.
An October 19 update names ransomware operators. Unit 42 says it still sees attempted exploitation by Spikey Scorpius (also called Qilin) and Tarnished Scorpius (also called Inc). It also knows of public reports linking users of Settra ransomware to the flaw.
Unit 42 says attackers use the flaw to get in, then get past multi-factor authentication to open a VPN session. They typically then scout the internal network with remote monitoring and management (RMM) tools. IT teams use these tools legitimately too. Next, the attackers stage tools for stealing credentials, taking data and deploying ransomware.
One caveat. The brief keeps an early line saying no activity after access had been seen. It also says few probed devices formed VPN sessions. Later sections describe follow-on activity. Read the brief as a record that grew over time.
The step that skips endpoint tools
Unit 42 calls the move to the virtualization layer the biggest change in attacker methods it describes. In one case, the attackers' next stop after the VPN was vCenter, the console that manages virtual servers. They then switched off safeguards on ESXi hosts, the software that runs those servers. The brief names the setting execInstalledOnly.
Unit 42 does not link this case to Qilin, Inc or any other named group. Do not read the vCenter case as the work of the ransomware operators named above.
The attackers then used a custom tool to pull credentials from a domain controller's virtual disk (VMDK). A domain controller holds the logins for the whole organization. A virtual disk is a file that stands in for a server's hard drive.
Unit 42 says this route bypasses endpoint detection and response (EDR) tools and other controls running inside the guest, meaning the server itself. It calls the method a sophisticated way to get domain-wide credentials. Unit 42 also saw access like this paired with exploit tools aimed at Veeam backup systems, CVE-2023-27532.
Why it matters: tools inside a server cannot see beneath it
This is the publication's argument, not a finding from the brief. Tools that live inside a server cannot see what happens beneath it. An attacker who reads a server's disk from the layer below never meets them.
It is like cameras in every apartment while someone copies the apartment from the landlord's records. What matters is who can reach the management layer. How that access is watched matters just as much.
The brief describes this from one case. It does not say every intrusion follows this path.
A second exposure Unit 42 keeps finding
Separately, Unit 42 describes a pattern from incident response work tied to the Lunar Peak campaign. In many cases, a setting had tied GlobalProtect to the web services on the firewall's admin interface. That can leave the admin pages open to the internet on ports 4443 and 3879. Administrators often did not know.
Unit 42 suggests a quick test. From an outside web browser, try an HTTPS connection to the management IP address on those two ports. To fix it, review Palo Alto Networks documentation on Interface Management profiles and limit access.
Questions to put to your team
First, are our PAN-OS versions fixed, or covered by the advisory's workarounds for CVE-2026-0257? Second, do our GlobalProtect logs show successful gateway connections that match Unit 42's indicators? Unit 42 advises starting incident response for any match.
Third, what can a VPN user reach? Can that address pool talk to vCenter or ESXi? Fourth, who watches the hypervisor and backup layers? Is the Veeam flaw CVE-2023-27532 closed? Fifth, which RMM tools are approved, so an unapproved one stands out?
A stolen VPN session is only the first door. The cost depends on what sits behind it.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Palo Alto Networks Unit 42.
