Active Exploitation of PAN-OS CVE-2026-0257 Drivers Pivots to Hypervisors and Domain…

Ransomware operators are actively targeting edge infrastructure by exploiting a critical Palo Alto Networks PAN-OS vulnerability, tracked as CVE-2026-0257. Attackers are abusing an authentication bypass flaw in the GlobalProtect portal and gateway interface to circumvent multi-factor authentication (MFA) controls, gain initial network access, and execute direct pivots into core virtualization infrastructure.

Multiple ransomware groups—including Spikey Scorpius (operating Qilin ransomware), Tarnished Scorpius (operating Inc Ransomware), and threat actors deploying Settra ransomware—have integrated this exploit into their operational playbooks. Given that perimeter devices like VPN gateways serve as trusted entry points, successful exploitation effectively hands attackers an encrypted, authenticated tunnel directly into internal enterprise segments.

Vulnerability Mechanics and Exploit Dynamics

At its core, CVE-2026-0257 stems from an authentication flaw categorized under CWE-565 (reliance on cookies without validation or integrity check) within the portal and gateway components of PAN-OS. By crafting modified HTTP requests and manipulating session cookie parameters sent to exposed GlobalProtect interfaces, an unauthenticated remote attacker can bypass authentication routines entirely.

The underlying metrics paint a clear picture of the risk profile. The flaw carries a CVSS v3.1 vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, indicating low attack complexity, network accessibility, and zero required privileges or user interaction. Empirical threat data scores the Exploit Prediction Scoring System (EPSS) probability at 96.9%—placing it in the 99.9th percentile of all tracked vulnerabilities.

Affected systems encompass Palo Alto Networks devices running PAN-OS versions prior to 10.2.7, as well as specific builds spanning 10.2.7 through 10.2.11. Once an attacker submits the crafted requests against a vulnerable endpoint, the gateway processes the connection as a legitimate user session, generating gateway-connected events and dropping the attacker onto the corporate VPN segment without triggering traditional secondary authentication challenges.

How Attackers Bypass GlobalProtect to Target the Virtualization Layer

While initial access relies on perimeter exploit tools, the post-exploitation tradecraft observed in recent incidents highlights a shift toward hypervisor compromise. After establishing a valid VPN session through the GlobalProtect authentication bypass, threat actors perform internal network reconnaissance using dual-use Remote Monitoring and Management (RMM) software to map out administrative infrastructure.

Rather than attempting standard lateral movement across individual Windows workstations where endpoint detection and response (EDR) agents are fully active, attackers move directly to VMware vCenter management appliances. Upon obtaining vCenter access, operators execute a structured attack path against the ESXi hosts:

1. Disabling Hypervisor Security Controls: Threat actors alter hypervisor configurations, specifically disabling the execInstalledOnly advanced setting on ESXi hosts to permit the execution of unauthorized binaries directly within the hypervisor console.
2. Offline Credential Harvesting via VMDKs: The attackers mount or access the virtual disk files (.vmdk) belonging to Active Directory Domain Controllers directly from the hypervisor storage backend.
3. Bypassing Endpoint Security: Using custom offline extraction utilities executed at the ESXi host layer, attackers extract the NTDS.dit database directly from the offline virtual disk. Because this extraction occurs at the hypervisor level rather than inside the running Windows guest operating system, in-guest EDR tools never inspect the process or detect the NTDS credential dump.

To maximize operational impact and lock down recovery avenues, threat actors have also been observed chaining this breach vector with secondary infrastructure exploits, such as targeting exposed Veeam backup servers via CVE-2023-27532 to delete or encrypt system backups prior to deploying final ransomware payloads.

Threat Actor Attribution: Qilin, Inc, and Settra

Threat intelligence confirms that multiple distinct threat groups are leveraging CVE-2026-0257 in ongoing intrusion campaigns across various industry sectors.

• Spikey Scorpius (Qilin): Known for aggressive double-extortion tactics, this group relies heavily on perimeter access tools to establish persistent access before deploying Linux-variant ransomware binaries specifically targeted at ESXi datastores.
• Tarnished Scorpius (Inc Ransomware): This group frequently utilizes compromised VPN access to stage internal exfiltration tooling and customized credential harvesters.
• Settra Ransomware Affiliates: Public reporting indicates separate clusters of threat actors deploying Settra ransomware are actively leveraging public proof-of-concept (PoC) code to automatedly scan and compromise vulnerable GlobalProtect portals.

Initial probes often involve automated scanning tools utilizing hard-coded client configuration values or suspicious host IDs. While early telemetry indicated a high volume of failed probe attempts, successful sessions result in full network entry, followed within hours by credential staging and lateral movement.

Remediation and Technical Guidance

Organizations deploying Palo Alto Networks GlobalProtect gateways must treat CVE-2026-0257 as a critical priority. Defenders should execute the following technical measures immediately:

• Upgrade PAN-OS: Apply fixed software releases beyond PAN-OS 10.2.11 for all affected gateway and portal devices. If immediate upgrades are not feasible, implement recommended vendor workarounds to restrict portal access.
• Log Analysis and Threat Hunting: Query GlobalProtect connection logs for successful gateway-connected events originating from unexpected external IP addresses or matching known PoC client parameters. Look for anomalous host IDs or device names associated with initial connection handshakes.
• Harden Virtualization Infrastructure: Isolate vCenter appliances and ESXi management interfaces onto restricted, non-routable management VLANs accessible only via secure jump boxes. Audit ESXi host configurations to ensure execInstalledOnly enforcement is enabled and unauthorized shell sessions are strictly monitored.
• Patch Secondary Infrastructure: Verify that backup management software, including Veeam environments, is updated against CVE-2023-27532 and other known infrastructure vulnerabilities to prevent credential reuse and secondary staging.