Palo Alto Networks’ Unit 42 says the Qilin and INC ransomware groups are still exploiting CVE-2026-0257, an authentication bypass in PAN-OS and Prisma Access, and have begun pivoting from compromised VPN gateways straight into the virtualization layer. The flaw lets attackers bypass multi-factor authentication, and it was patched in May 2026.
CVE-2026-0257: MFA Bypass in PAN-OS and Prisma Access
CVE-2026-0257 carries a CVSS score of 7.8. It lets attackers set up unauthorized VPN connections and bypass MFA. The flaw affects PAN-OS and Prisma Access. Palo Alto patched it in May 2026, and CISA added it to the Known Exploited Vulnerabilities catalog on May 13, 2026.
Unit 42 reports continued exploitation by Qilin, which it tracks as Spikey Scorpius, and INC, tracked as Tarnished Scorpius. ReliaQuest saw Qilin and Settra groups exploiting the flaw days earlier. A separate report says multiple ransomware groups have attacked PAN-OS since June.
The vulnerability is distinct from CVE-2026-0322, a PAN-OS remote code execution zero-day reported earlier this month.
New Tradecraft: From VPN Gateway to vCenter and ESXi
Once inside through the VPN gateway, attackers are going after the virtualization layer rather than only individual hosts.
One Intrusion Path Through the Virtual Disk
The newest tactic is pivoting directly to the virtualization layer. In one case, attackers moved from the VPN gateway to the vCenter appliance. They disabled the ESXi execInstalledOnly setting and then performed offline credential dumping from a domain controller’s virtual disk, known as a VMDK.
Dumping credentials offline from a virtual disk takes place outside the domain controller’s running guest operating system.
Sectors Targeted
Targeted sectors include education, financial services, healthcare, high tech, hospitality, manufacturing, legal, government, transport, utilities and retail. The list covers a broad cross-section of organizations that use VPN access to the network edge.
Timeline of CVE-2026-0257 Exploitation
Palo Alto patched the flaw in May 2026, and CISA added it to the KEV catalog on May 13. According to one report, ransomware exploitation has been under way since June. Unit 42 published its update on October 19 and 20, describing continued exploitation and the new vCenter and ESXi techniques.
The chain of events in the reported intrusion runs through four steps. Attackers exploit CVE-2026-0257 to create an unauthorized VPN connection that bypasses MFA. They move from the VPN gateway to the vCenter appliance. They disable the ESXi execInstalledOnly setting. And they dump credentials offline from a domain controller’s virtual disk.
Unit 42’s update comes several months after the flaw’s patch and KEV listing in May. ReliaQuest observed Qilin and Settra exploiting it days before the Unit 42 report, which indicates that more than one ransomware operation has adopted it. Palo Alto has published Unit 42 guidance.
Impact and Response
Compromised VPN access, in these cases, leads to hypervisor-level ransomware deployment. A single VPN foothold that reaches vCenter can open access to every virtual machine the appliance manages, including domain controllers.
Palo Alto’s response is to patch PAN-OS and Prisma Access, and Unit 42 has published guidance. Organizations that run unpatched versions remain exposed to a flaw that has been on CISA’s exploited-vulnerability list for more than five months.
The sectors Unit 42 lists are broad: education, financial services, healthcare, high tech, hospitality, manufacturing, legal, government, transport, utilities and retail. That spread suggests the exploitation is opportunistic with respect to industry, with the common factor being an exposed PAN-OS or Prisma Access deployment rather than a particular type of victim. The patch has been available since May. CISA’s KEV listing on May 13 set the federal expectation for remediation months ago, and the Unit 42 update shows that the flaw remains useful to ransomware operators well after that point. ReliaQuest’s earlier observation of Qilin and Settra activity, and the separate report of attacks since June, place the exploitation timeline across at least four months.
The persistence of exploitation long after a patch and a KEV listing shows how long unpatched edge devices stay in use. The new element in this update is not the entry point, which is months old, but what attackers do after they use it: they move quickly to the virtualization management layer rather than staying on individual servers.
