PALO Alto Networks has disclosed that exploitation of a patched PAN-OS and Prisma Access flaw, CVE-2026-0257 (CVSS 7.8), is continuing in financially motivated campaigns. The vulnerability is an authentication bypass that could allow attackers to establish unauthorized VPN connections. CSIA added the CVE to its Known Exploited Vulnerabilities (KEV) catalog on 13 May 2026.
Unit 42 researchers report that ransomware operators including Spikey Scorpius (aka Qilin) and Tarnished Scorpius (aka INC) are actively weaponising this flaw to gain initial footholds and bypass multi-factor authentication to set up VPN sessions.
Once footholds are established, the actors conduct internal network reconnaissance, utilising dual-use RMM tools, and then move laterally via RDP and SMB. They stage additional tooling for credential harvesting, data exfiltration and ransomware deployment. The campaigns have reportedly targeted a broad range of sectors, from education and financial services to healthcare, manufacturing, government and energy, with activity also touching utilities, transport and retail.
A notable evolution in technique is the pivot to the virtualization layer after exploitation: attackers have moved from VPN gateways to vCenter management appliances, disabling ESXi security controls (execInstalledOnly) and using offline credential dumping against a domain controller’s virtual disk (VMDK). This approach can evade in-guest EDR and protectors, enabling domain-wide credential access.
Palo Alto Networks urges organisations to apply patches promptly, hunt for indicators of compromise, and activate incident response processes for any successful gateway-connected events.