Palo Alto Networks Unit 42 updated its CVE-2026-0257 threat brief on Oct 19. It says it continues to see attempted exploitation by ransomware operators, including Spikey Scorpius (Qilin) and Tarnished Scorpius (Inc), and notes ReliaQuest's public reporting that actors using Settra ransomware are exploiting it too. CVE-2026-0257 is an authentication bypass in the GlobalProtect portal and gateway that lets an attacker start unauthorized VPN sessions. It has been in CISA KEV since May 13, 2026, and a public PoC appeared May 29. Unit 42's Oct 19 update (4:00 PM PT) also lists what follows access: RMM-tool recon, RDP/SMB lateral movement and staging for credential theft, exfiltration and ransomware. In one case the attackers pivoted to vCenter, disabled ESXi execInstalledOnly, and dumped domain credentials offline from a domain controller's VMDK. See our virtualization-layer hunt.

Do now: confirm GlobalProtect is on a fixed PAN-OS release or has the advisory's mitigations in place. Then hunt GlobalProtect logs for successful gateway-connected events with placeholder host IDs or device names (aa:bb:cc:dd:ee:ff, 00:11:22:33:44:55, WINDOWS-LAPTOP-001, DESKTOP-GP01, GP-CLIENT) or the PoC's hard-coded values (endpoint_os_version "Microsoft Windows 10 Pro 64-bit" with an empty source_user_info.domain). Treat any hit as an incident, since ransomware crews are now using this entry point.