The notable part of this story is not that a VPN appliance flaw is being exploited. It is where the attackers go once they are through it.
In an update published on October 20, Unit 42 reported that ransomware operators are still exploiting CVE-2026-0257, an authentication bypass affecting PAN-OS and Prisma Access that lets an unauthorized party stand up a VPN connection. The flaw carries a CVSS score of 7.8, was patched in May 2026, and was added to CISA’s Known Exploited Vulnerabilities catalog on May 13, 2026. Five months later, it is still producing incidents.
MFA was not defeated here. It was skipped. And in at least one investigation, the attackers walked past endpoint detection entirely by moving to the layer underneath it.
What Happened
Unit 42 names two ransomware operations using the bug as a way in: Spikey Scorpius, better known as Qilin, and Tarnished Scorpius, better known as Inc. Public reporting from ReliaQuest also ties exploitation to actors deploying Settra ransomware, and Arctic Wolf flagged Qilin’s use of the flaw back in July.
The pattern after initial access is familiar. The attackers establish a VPN session, having bypassed the MFA controls in front of it, then survey the network using dual-use remote monitoring and management tools, which look like admin software because they are admin software. Movement happens over RDP and SMB. Then they stage what they need for credential theft, data theft and encryption.
What is new is the destination. Unit 42 calls the direct move into the virtualization layer the “most significant evolution” in how these intrusions unfold. In one case the attackers went from the compromised VPN gateway to the vCenter management appliance, turned off a protective setting on the ESXi hosts (execInstalledOnly), and then used a custom tool to pull credentials straight out of a domain controller’s virtual disk file while it sat on the datastore.
That last step deserves a slow read. The domain controller’s EDR agent never saw it, because the attack never happened inside the guest operating system. It happened to the file that contains the guest operating system.
Unit 42 also observed these intrusions chained with tooling aimed at Veeam backup infrastructure, using CVE-2023-27532. The affected organizations span education, financial services, healthcare, manufacturing, government, legal, transportation, utilities, hospitality and retail, which is another way of saying the targeting is opportunistic rather than selective.
Why This Matters for Businesses
Three things follow from this, and none of them are about Palo Alto Networks specifically.
A patch that exists is not a patch that is applied. Edge appliances are the hardest things in a mid-market environment to take offline. They are the firewall, they are the VPN, and updating them means a maintenance window that someone has to defend to the business. So the window gets scheduled, then moved, then forgotten, and the appliance keeps working perfectly, which is exactly what makes it easy to stop thinking about. A federal KEV listing in May did not change that for everyone.
MFA sits behind the authentication layer, not in front of it. Most organizations treat multi-factor as the boundary. It is not. It is a control that runs after the gateway decides who it is talking to. If the gateway can be convinced it already knows you, there is nothing for MFA to challenge.
EDR coverage usually stops at the hypervisor. Businesses buy endpoint protection for servers and laptops, because that is how endpoint protection is sold and that is where the agents install. vCenter and the ESXi hosts typically have no agent, limited log forwarding and no alerting that anyone reads. The attacker’s most damaging phase therefore runs in the one place nobody is watching, which is probably not a coincidence.
Add the backup server to the same intrusion and the math changes from expensive to existential. An encryption event you can restore from is a bad week. An encryption event where the backup infrastructure was compromised first is a question about whether the business continues.
What Organizations Should Consider
The useful thing about this particular story is that every check is verifiable this week, by one person, with no new spending.
Confirm the fix is actually on the box. Not that it was approved. Not that it is in the change queue. Ask your IT team for the running PAN-OS version on each gateway and portal and compare it against the vendor advisory. If an upgrade genuinely cannot happen yet, Unit 42 lists mitigations: issue a dedicated certificate used only for Authentication Override cookies and keep it out of every other use, or turn Authentication Override off in the portal and gateway configuration.
Check whether your management interface is quietly on the internet. Unit 42 describes a recurring misconfiguration where GlobalProtect profiles get mapped to HTTP/HTTPS services on the management interface, which exposes it publicly on ports such as 4443 and 3879, often without the administrator realizing. Their suggested test is blunt and takes a minute: from outside your network, in a browser, try to reach your management IP on those ports.
Ask who is watching vCenter and ESXi. The question to put to your IT team or provider is not “are the hosts patched”. It is “where do vCenter and ESXi logs go, and what happens if someone logs in at 3am and changes a host setting”. If the honest answer is that nothing happens, you have found the gap this campaign is built around.
Treat the backup server as a separate trust zone. Is it on the same domain as everything else? Can it be reached from a standard workstation? Is it patched on the same schedule as production, or on the schedule reserved for things nobody wants to restart? CVE-2023-27532 is from 2023. It is still being used because it is still there.
Use the KEV catalog as your queue. CISA publishes it free, and it is a list of vulnerabilities confirmed to be exploited in the real world rather than merely scored as dangerous. Working it top down against your internet-facing inventory is one of the highest-value hours an IT team can spend.
How ISM Can Help
This incident sits across four of the things we do. Cybersecurity & Risk Management covers the part most organizations are missing here: monitoring and detection that includes the virtualization layer and the backup infrastructure, not just the systems where an agent happens to install cleanly.
Managed IT Services is where the patching discipline lives. Edge appliance updates get missed because nobody owns the maintenance window, and that is an operational problem before it is a security one.
Identity & Access Management addresses the uncomfortable lesson in this campaign, which is that MFA only protects what it actually stands in front of. Mapping where authentication really happens, and what is privileged on the other side of it, is worth doing before someone else maps it for you.
Penetration Testing answers the question the three checks above cannot: whether a tester who gets a VPN session can reach vCenter, and how long it takes. You can see our full service list on the services page.
Talk With Our Team
If you run a Palo Alto gateway, a VMware estate or a backup server you have not restarted in a while, that is a short and worthwhile conversation to have with us. We can walk the three checks in this article with your team, tell you what we find, and be straightforward about what is fine and what is not. Get in touch and we will set up a time.
If you would rather take your own measure first, the Cyber Maturity Calculator gives you a sense of where your controls stand before you talk to anyone.
Sources
- Active Exploitation of May 2026 PAN-OS CVE-2026-0257 (Updated October 20), Unit 42, Palo Alto Networks
- Qilin and INC Ransomware Groups Exploit Palo Alto Networks Flaw to Bypass MFA, The Hacker News