Palo Alto Networks has disclosed ongoing exploitation of a patched authentication bypass vulnerability in PAN-OS and Prisma Access, tracked as CVE-2026-0257. The flaw, which carries a CVSS score of 7.8, allows attackers to set up unauthorized VPN connections. It was fixed in May 2026 and added to CISA's Known Exploited Vulnerabilities catalog on May 13, 2026.
According to Unit 42, the ransomware groups Qilin (Spikey Scorpius) and INC (Tarnished Scorpius) are using the flaw to gain initial access, bypass MFA, and establish VPN sessions. After that, they conduct reconnaissance with remote monitoring and management tools, move laterally via RDP and SMB, and stage tooling for credential theft and ransomware deployment. A notable shift is the pivot to the virtualization layer: in one case, attackers moved from the compromised VPN gateway to vCenter, disabled security controls on ESXi hypervisors, and used a custom tool to dump credentials directly from a domain controller's virtual disk, evading in-guest endpoint detection.
The source notes that ReliaQuest previously detected both Qilin and Settra exploiting the flaw, while Unit 42 attributes the activity to Qilin and INC, so researchers differ on the exact groups behind some attacks. Palo Alto recommends applying the latest fixes, hunting for indicators of compromise, and initiating incident response if successful gateway-connected events are found.