CVE-2023-27532MalwarePublished 10/20/2026

Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257

Affects Veeam Backup & ReplicationSource AlienVault OTX General

Severity

Unrated

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 08/22/2023
KEV deadline: 09/12/2023
Ransomware: Used in ransomware campaigns
EPSS: 80.6% chance of exploitation in 30 days – higher than 99% of CVEs

What to do

CISA required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Description

Active exploitation of PAN-OS vulnerability CVE-2026-0257 targets GlobalProtect portal and gateway components. This authentication bypass flaw allows unauthorized attackers to circumvent security controls and establish VPN connections. Ransomware operators including Spikey Scorpius (Qilin), Tarnished Scorpius (Inc), and Settra ransomware actors exploit this vulnerability to gain initial network access. Post-exploitation activities include bypassing multi-factor authentication, internal reconnaissance, lateral movement via RDP and SMB, credential harvesting, and ransomware deployment. Sophisticated tactics involve pivoting to the virtualization layer, accessing vCenter management appliances, disabling ESXi hypervisor security controls, and offline credential dumping from domain controller virtual disks. Multiple industries have been impacted. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.

Summary

CVE-2026-0257 is an authentication bypass vulnerability in PAN-OS affecting GlobalProtect portal and gateway components. Exploitation allows unauthorized attackers to establish VPN connections without proper authentication. Threat actors, including ransomware groups Spikey Scorpius (Qilin), Tarnished Scorpius (Inc), and Settra, actively exploit this flaw to gain initial access. After exploitation, attackers bypass multi-factor authentication, perform internal reconnaissance using remote monitoring tools, move laterally using RDP and SMB protocols, and stage tools for credential harvesting and ransomware deployment. Advanced techniques include pivoting to virtualization infrastructure by accessing vCenter management appliances, disabling security controls on ESXi hypervisors, and performing offline credential dumping against domain controller virtual disks. The exploitation has affected multiple industries. No patch or official remediation information is provided in the source data.

Impact

The vulnerability enables unauthorized attackers to bypass authentication controls on PAN-OS GlobalProtect VPN portals and gateways, allowing them to establish VPN connections without valid credentials. This initial access facilitates bypassing multi-factor authentication, internal reconnaissance, lateral movement, credential harvesting, and ransomware deployment. The attackers' ability to pivot to virtualization layers and disable hypervisor security controls significantly increases the potential impact by compromising domain controller credentials and infrastructure management. Multiple industries have been impacted, indicating broad exploitation.

Defensive guidance

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or mitigation details are provided in the available data. Organizations should monitor vendor communications for updates and apply patches or mitigations as soon as they become available.

Weaknesses

CWE-306Missing Authentication for Critical Function (opens in a new tab)

Indicators of compromise

CVEs 2

CVE-2023-27532
CVE-2026-0257

IP addresses 4

146.19.216.119
146.19.216.125
146.19.216.120
23.128.228.6

What to do

Description

AnalysisAI-generated, updated 10/24/2026, 08:19:57 UTC

Technical details

Weaknesses

Indicators of compromise

CVEs 2

IP addresses 4

Related threats