OTX-6ad79104128abd6fe9532c09 info

Description

Active exploitation of PAN-OS vulnerability CVE-2026-0257 has been observed, targeting GlobalProtect portal and gateway components. The authentication bypass flaw allows unauthorized attackers to circumvent security controls and establish VPN connections. Ransomware operators including Spikey Scorpius (Qilin) and Tarnished Scorpius (Inc), along with Settra ransomware actors, are exploiting this vulnerability to gain initial network access. Following successful exploitation, threat actors bypass multi-factor authentication, conduct internal reconnaissance using remote monitoring tools, move laterally via RDP and SMB, and stage additional tooling for credential harvesting and ransomware deployment. A sophisticated tactic observed involves pivoting directly to the virtualization layer, accessing vCenter management appliances, disabling security controls on ESXi hypervisors, and performing offline credential dumping against domain controller virtual disks. Multiple industries have been impacted including educa... Pulse contains 6 indicator(s) (IOCs). View on OTX to inspect.

Indicators of Compromise (6)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

References (2)

• OTX pulse AlienVaulkt OTX

  Active exploitation of PAN-OS vulnerability CVE-2026-0257 has been observed, targeting GlobalProtect portal and gateway components. The authentication bypass flaw allows unauthorized attackers to circumvent security controls and establish VPN connections. Ransomware operators including Spikey Scorpius (Qilin) and Tarnished Scorpius (Inc), along with Settra ransomware actors, are exploiting this vulnerability to gain initial network access. Following successful exploitation, threat actors bypass

• reference AlienVaulkt OTX

• Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257
  web:cybernoz.com

  Palo Alto Networks Unit 42 has observed active exploitation of PAN-OS vulnerability CVE-2026-0257 by an unidentified threat actor attempting to access GlobalProtect. This security flaw involves an authentication bypass in the portal and gateway components of vulnerable versions of PAN-OS ® software, which could allow unauthorized attackers to circumvent security controls and initiate VPN ...

  2026-10-21 09:24 UTC
• PAN-OS CVE-2026-0257 Active Exploitation: Ransomware & GlobalProtect ...
  web:heathernicoleclark.com

  Active Exploitation of PAN-OS CVE-2026-0257 : What Organizations Need to Know Ransomware groups, including Spikey Scorpius (Qilin), Tarnished Scorpius (Inc), and Settra, are actively exploiting the PAN-OS vulnerability CVE-2026-0257 . This vulnerability allows attackers to bypass authentication in Glo...

  2026-10-21 09:24 UTC
• CVE-2026-0257 PAN-OS: GlobalProtect Authentication Bypass Vulnerabilities
  web:security.paloaltonetworks.com

  Palo Alto Networks Security Advisory: CVE-2026-0257 PAN-OS : GlobalProtect Authentication Bypass Vulnerabilities Authentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS ® software allows the attacker to bypass security restrictions and establish an unauthorized VPN connection. Panorama and Cloud NGFW are not impacted by these issues.

  2026-10-21 09:24 UTC
• CVE-2026-0257: PAN-OS Vulnerability Under Active Exploitation by Qilin ...
  web:securityarsenal.com

  Qilin and INC ransomware operators are actively exploiting PAN-OS CVE-2026-0257 . Organizations running Palo Alto Networks firewalls must patch and hunt for compromise now.

  2026-10-21 09:24 UTC
• CVE-2026-0257: PAN-OS Exploitation and Ransomware Attacks (2026)
  web:summitcityhosts.com

  Threat Brief : Active Exploitation of PAN-OS CVE-2026-0257 Palo Alto Networks Unit 42 has reported active exploitation of CVE-2026-0257 , an authentication bypass vulnerability in the portal and gateway components of vulnerable PAN-OS software versions. This security flaw allows unauthorized attackers to circumvent security controls, bypass multi-factor authentication (MFA), and initiate ...

  2026-10-21 09:24 UTC
• Active Exploitation of PAN-OS CVE-2026-0257: What You Need to Know (2026)
  web:theswalerooms.com

  Threat Actors and Evolution of Tactics As of October 19, 2026 , threat intelligence indicates that multiple ransomware operators are actively leveraging CVE-2026-0257 to compromise corporate environments across a broad range of industries—including education, financial services, healthcare, government, manufacturing, and energy.

  2026-10-21 09:24 UTC
• PAN-OS GlobalProtect CVE-2026-0257 exploitation - threat.wiki
  web:threat.wiki

  PLEX2SHELL: Plex Media Server FOUR- CVE chain ( CVE - 2026 -96652 unauth SSRF /player/timeline + 96654 searchOne owner-token theft + 96655 authed SSRF /video/:/transcode/universal carrier-video + 96656 path-control ELF write+execute in Codecs dir) UNDER ACTIVE EXPLOITATION began ONE DAY after Oct-16 PoC publication, patched 1.43.3.10861 Aug 3 ...

  2026-10-21 09:24 UTC
• Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257 (Updated ...
  web:turfturfturf.com

  Active Exploitation of PAN-OS CVE-2026-0257 : A Comprehensive Guide This article provides an in-depth look at the active exploitation of the PAN-OS vulnerability CVE-2026-0257 , as observed by Palo Alto Networks Unit 42. The vulnerability, which involves an authentication bypass in PAN-OS software, has been exploited by unidentified threat actors to gain initial access to corporate networks.

  2026-10-21 09:24 UTC
• Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257 (Updated ...
  web:unit42.paloaltonetworks.com

  Ransomware operators including Spikey Scorpius (aka Qilin) and Tarnished Scorpius (aka Inc) are exploiting PAN-OS vulnerability CVE-2026-0257 .

  2026-10-21 09:24 UTC
• CVE-2026-0257: Active Exploitation of PAN-OS Vulnerability - IOCs and ...
  web:vuln.today

  CVE-2026-0257 : Active Exploitation of PAN-OS Vulnerability - IOCs and Mitigations Analysis Detailed AI-generated intelligence summary covering attack vector, impact assessment, affected versions, remediation steps, and indicators of compromise.

  2026-10-21 09:24 UTC

Only Available for Registered Users. Sign in to view.