Overview of Active Exploitation of PAN-OS GlobalProtect CVE-2026-0257
Unit 42 has observed active exploitation of CVE-2026-0257, an authentication bypass vulnerability affecting the portal and gateway components of vulnerable versions of Palo Alto Networks PAN-OS software. This critical flaw allows unauthorized attackers to circumvent security controls and initiate virtual private network (VPN) connections, gaining an initial foothold into corporate networks. Multiple ransomware operators, including Spikey Scorpius (also known as Qilin) and Tarnished Scorpius (also known as Inc), are leveraging this vulnerability in ongoing campaigns. Public reports also attribute exploitation to threat actors utilizing Settra ransomware. Fixes for this issue have been available since May 2026, yet limited exploit attempts continue on unpatched devices without mitigations applied, according to Unit 42. This vulnerability was added to the Known Exploited Vulnerability (KEV) catalog on May 13, 2026, underscoring the urgent need for remediation.
Technical Analysis of CVE-2026-0257 Exploitation
The CVE-2026-0257 vulnerability specifically targets the authentication mechanisms within PAN-OS GlobalProtect portal and gateway components. Attackers are exploiting this flaw to bypass multi-factor authentication (MFA) controls, enabling them to establish unauthorized VPN sessions. While only a small fraction of probed devices have successfully established VPN connections, any successful gateway-connected event merits immediate investigation.
A significant evolution in tactics, techniques, and procedures (TTPs) observed following successful exploitation of CVE-2026-0257 is the direct pivot to the virtualization layer. In one documented case, threat actors moved from the compromised VPN gateway to the vCenter management appliance. From there, they disabled security controls on ESXi hypervisors, specifically the execInstalledOnly setting. This step facilitates the deployment of custom tools for offline credential dumping directly against a domain controller’s virtual disk (VMDK). This highly sophisticated method allows for the acquisition of domain-wide credentials, effectively bypassing in-guest endpoint detection and response (EDR) and other security controls that would typically detect such activities.
Furthermore, attackers are observed chaining this initial access with other exploit tools, such as those targeting Veeam backup infrastructure (CVE-2023-27532), to maximize their impact and achieve broader network compromise. This demonstrates a clear intent for deep and persistent access.
Common Misconfigurations Facilitating Exploitation
Unit 42’s incident response engagements, notably during the Lunar Peak campaign, revealed a recurring misconfiguration that inadvertently exposes GlobalProtect services. Organizations frequently map GlobalProtect (GP) profiles to HTTP/HTTPS services on their management interfaces. This setup can expose the management interface to the internet on specific ports, commonly 4443 and 3879, often without administrators’ explicit knowledge. Such exposure increases the attack surface for vulnerabilities like CVE-2026-0257, highlighting a critical blind spot for many organizations.
Actionable Recommendations for CVE-2026-0257 Mitigation
To protect against active exploitation of CVE-2026-0257 and related advanced TTPs, organizations must prioritize immediate action.
- Patch Immediately: The most critical step is to apply the available fixes for CVE-2026-0257 without delay. These patches have been available since May 2026. Consult the official Palo Alto Networks Security Advisory for detailed guidance on upgrades and hotfixes.
- Implement Workarounds/Mitigations: If immediate patching is not feasible, implement the recommended workarounds and mitigations provided by Palo Alto Networks. These can significantly reduce exposure.
- Proactive Threat Hunting: Actively hunt for indicators of compromise (IoCs) within GlobalProtect logs. Specifically, search for successful gateway-connected events originating from suspicious IP addresses, host IDs, or device names identified in threat intelligence reports. For pre-proof-of-concept release activities, search for specific IP addresses in GlobalProtect logs for successful login connections. Post-PoC release monitoring should focus on successful gateway-connected events matching hard-coded client configuration values from public exploit code.
- Enhance Incident Response Protocols: For any successful gateway-connected events linked to suspicious indicators, activate incident response protocols immediately. Investigate any post-access behavior or lateral movement attempts.
- Review GlobalProtect Configurations: Scrutinize configurations for unintended exposure of management interfaces. Ensure GlobalProtect profiles are not inadvertently mapped to HTTP/HTTPS services on ports like 4443 or 3879 that are exposed to the internet. Correcting these misconfigurations is vital for strengthening your perimeter. This will help in preventing further Palo Alto Networks GlobalProtect authentication bypass mitigation issues.
- Utilize Exposure Management Tools: Leverage tools like Palo Alto Networks Cortex Xpanse to identify publicly exposed PAN-OS gateways and GlobalProtect portals, allowing for proactive remediation of external attack surfaces.
By following these recommendations, organizations can significantly reduce their risk of compromise from CVE-2026-0257 and strengthen their overall security posture against sophisticated ransomware groups employing these Spikey Scorpius TTPs after initial access. Prompt action is crucial to prevent initial access and subsequent lateral movement into critical infrastructure. Regular monitoring and adherence to best practices for network segmentation and credential management are also essential for detecting CVE-2026-0257 exploitation.
Related: CVE-2026-84115: Cleo Harmony Auth Bypass Exploit Published, Data Analyst Sentenced to Prison for Extorting Brightly Software