PAN-OS flaw exploited to reach virtualized systems
The PAN-OS flaw tracked as CVE-2026-0257 is still being exploited by ransomware operators to establish unauthorized virtual private network (VPN) connections and enter corporate environments. Palo Alto Networks says the authentication bypass affects PAN-OS and Prisma Access and carries a CVSS severity score of 7.8. The company patched the vulnerability in May 2026. The U.S. Cybersecurity and Infrastructure Security Agency added it to the Known Exploited Vulnerabilities (KEV) catalog, a list of security flaws confirmed to be under active attack, on May 13, 2026.
Unit 42 said in an update shared Monday that operators associated with Qilin, which it tracks as Spikey Scorpius, and INC, tracked as Tarnished Scorpius, have exploited the vulnerability. Days earlier, ReliaQuest reported active exploitation by Qilin and Settra in financially motivated attacks. According to Unit 42, the flaw provides an initial entry point into a company network and allows attackers to bypass multi-factor authentication (MFA), the additional identity check normally required after a password, when creating a VPN session.
Once connected, the attackers have performed internal reconnaissance using remote monitoring and management (RMM) software. These legitimate administration tools can also be misused to inspect and control compromised systems. The groups then moved between systems through Remote Desktop Protocol (RDP), which provides remote access to a computer, and Server Message Block (SMB), a technology commonly used to share files and other network resources. Unit 42 also observed attackers preparing tools for stealing sign-in credentials, removing data from the network and deploying ransomware.
The reported activity spans education, financial services, healthcare, high technology, hospitality, manufacturing, professional and legal services, government, transportation and logistics, utilities and energy, and retail. That range makes the issue relevant beyond organizations that regard themselves as likely ransomware targets. Any affected VPN gateway can provide a route toward business systems, hosted applications, administrative accounts and data if it remains unpatched or if attackers entered before the fix was applied.
Unit 42 identified a direct move into the virtualization layer as the most important change in tactics following successful exploitation. In one case, attackers progressed from the compromised VPN gateway to a vCenter management appliance, which centrally manages virtual machines running on ESXi hypervisors. They disabled the execInstalledOnly security control on the ESXi systems and used a custom tool to extract credentials offline from a domain controller's virtual disk, stored as a VMDK file. A domain controller manages sign-ins across a Windows environment, making its stored credentials particularly valuable to an intruder.
Working against the virtual disk allowed the attackers to operate outside the running guest system. Palo Alto Networks said this method can circumvent in-guest endpoint detection and response (EDR), security software that monitors activity inside a computer, along with other protections. The attackers could then obtain credentials with access across the domain. They have also combined the initial VPN compromise with other exploit tools, including attempts to abuse CVE-2023-27532 against Veeam backup infrastructure, increasing the potential impact on recovery systems as well as production workloads.
Arctic Wolf had previously reported Qilin exploiting CVE-2026-0257 in July 2026. The observed attacks ranged from operations focused on rapid file encryption to full double extortion, in which attackers combine encryption with data theft to increase pressure on the victim. For website owners and hosting teams, the central concern is that a compromised remote-access gateway can become a starting point for reaching administrative systems, virtualized workloads and backups rather than remaining an isolated VPN incident. Businesses strengthening the wider environment around remote access and hosted systems can also consider AEU-I, which provides security-first IT, infrastructure and consulting.
Palo Alto Networks recommends applying the latest fixes, actively searching for evidence of compromise and beginning appropriate incident response when successful gateway-connected events are found. Patching remains necessary, but organizations should not assume that installing the update removes an attacker who may already have connected. Reviewing successful VPN sessions, activity from remote administration tools, movement through RDP or SMB, changes to virtualization security controls and access to backup infrastructure can help determine whether the flaw was exploited before remediation.