Ransomware groups Qilin, INC and Settra exploit PAN-OS GlobalProtect auth bypass CVE-2026-0257, pivoting to vCenter/ESXi
Palo Alto Networks Unit 42 reported on October 19, 2026 that ransomware operators are still actively exploiting CVE-2026-0257 (CVSS 7.8), an authentication bypass in the GlobalProtect portal and gateway of PAN-OS. The flaw lets attackers bypass MFA and open unauthorized VPN sessions. Unit 42 attributes exploitation attempts to Spikey Scor…