PALO Alto Networks has disclosed that exploitation of a vulnerability in PAN-OS and Prisma Access continues to be observed by ransomware actors, despite the flaw being patched earlier this year. The flaw, tracked as CVE-2026-0257, is an authentication bypass that could allow an attacker to establish unauthorised VPN connections. Palo Alto Networks released the fix in May 2026, and the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-0257 to its Known Exploited Vulnerabilities (KEV) catalog on 13 May 2026.
Unit 42 researchers have identified specific ransomware operators using the vulnerability, naming Spikey Scorpius (also known as Qilin) and Tarnished Scorpius (also known as INC) as actors exploiting CVE-2026-0257. The article notes that exploitation is ongoing, indicating that despite the patch, threat groups are still leveraging the authentication bypass to gain access.
The report does not detail affected sectors or victim counts, but underscores the need for organisations using PAN-OS or Prisma Access to remain vigilant, ensure patches are applied, and monitor for indicators of compromise tied to these groups. The information is based on Unit 42 updates and coverage by The Hacker News.