Qilin, Inc Ransomware Bypasses MFA on PAN-OS Gateways via CVE-2026-0257
Threat actors use CVE-2026-0257 to bypass MFA on PAN-OS gateways, enabling VPN access and subsequent ransomware deployment in targeted networks.
Key points
- Ransomware operators including Qilin and Inc actively exploit CVE-2026-0257 to bypass authentication on PAN-OS GlobalProtect.
- The flaw allows attackers to circumvent MFA and establish VPN sessions, leading to network reconnaissance and credential harvesting.
- Palo Alto Networks Unit 42 advises hunting for specific indicators and applying available mitigations or upgrades immediately.
Palo Alto Networks Unit 42 reported active exploitation of CVE-2026-0257, an authentication bypass in PAN-OS software affecting GlobalProtect portal and gateway components. This vulnerability allows unauthorized attackers to circumvent security controls, including multi-factor authentication, to initiate virtual private network connections. The flaw was added to the Known Exploited Vulnerability catalog on May 13, 2026.
How it unfolded
- Unit 42 observed exploitation attempts starting in early June 2026, with ransomware operators targeting corporate networks across multiple industries.
- A proof-of-concept release occurred on May 29, 2026, after which attackers began using hard-coded client configuration values in their attacks.
- On October 19, 2026, Unit 42 updated its threat brief to confirm ongoing exploitation by groups including Spikey Scorpius and Tarnished Scorpius.
Who is affected
Ransomware operators using the aliases Spikey Scorpius (Qilin) and Tarnished Scorpius (Inc) are actively exploiting this vulnerability. Public reporting also attributes exploitation to threat actors deploying Settra ransomware. These actors leverage the flaw to gain an initial foothold, bypassing MFA to establish VPN sessions. Once connected, they conduct internal reconnaissance using remote monitoring tools and stage additional malware for credential harvesting and data exfiltration.
Our take on the response
Attackers have evolved their tactics to pivot directly to the virtualization layer after compromising a VPN gateway. In one instance, threat actors moved from the gateway to a vCenter management appliance. They disabled security controls on ESXi hypervisors and used custom tools to dump credentials from a domain controller's virtual disk. This method bypasses in-guest endpoint detection and response controls. Actors also chain this access with exploits targeting Veeam backup infrastructure, such as CVE-2023-27532, to maximize impact.
Who needs to act first
Teams should prioritize updating exposed gateway and portal systems before internal-only devices. Verify current PAN-OS versions against the vendor’s advisory to identify vulnerable instances. If immediate patching is not feasible, implement the recommended workarounds to restrict access. Monitor GlobalProtect logs for successful connections from unexpected sources or with suspicious host identifiers. Ensure backup systems are isolated from the primary network to prevent lateral movement. Test any configuration changes in a non-production environment first to avoid service disruption.
What to do and how to stay safe: PAN-OS
- Search GlobalProtect logs for successful gateway-connected events originating from IP addresses associated with known malicious activity.
- Look for successful logins using suspicious host IDs or device names that do not match organizational standards.
- Monitor for connections with hard-coded client configuration values, such as endpoint_os_version set to Microsoft Windows 10 Pro 64-bit.
- Consult the official Palo Alto Networks Security Advisory for detailed mitigation steps and upgrade paths to patched versions.
Step-by-step guide: Vulnerability Prioritization: How to Rank Risks Without Wasting Time
General security guidance from the Patch Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which ransomware groups are exploiting CVE-2026-0257?
Unit 42 observed exploitation by Spikey Scorpius (Qilin) and Tarnished Scorpius (Inc), while public reporting links the flaw to Settra ransomware actors.
Does this vulnerability allow attackers to bypass multi-factor authentication?
Yes, the authentication bypass in the portal and gateway components allows attackers to circumvent MFA controls and establish VPN sessions.
Is there a fix available for CVE-2026-0257?
Unit 42 recommends upgrading to a version that includes a fix or following available workarounds and mitigations detailed in the security advisory.
