Executive Summary
Palo Alto Networks has reported active exploitation of CVE-2026-0257, a critical authentication bypass vulnerability in PAN-OS and Prisma Access. Several ransomware groups, most notably Spikey Scorpius (Qilin) and Tarnished Scorpius (INC), are weaponizing this flaw to establish unauthorized VPN sessions. By exploiting this vulnerability, attackers can circumvent multi-factor authentication (MFA) to gain a foothold in targeted environments.
Technical analysis shows that once an initial foothold is established, threat actors pivot to the virtualization layer, specifically targeting vCenter management appliances. Attackers have been observed disabling security controls on ESXi hypervisors to perform offline credential dumping from Domain Controller virtual disks (VMDK). This method effectively bypasses in-guest endpoint detection and response (EDR) solutions, granting the adversaries domain-wide access.
The impact is significant, as the campaign targets a vast array of sectors including healthcare, finance, and critical infrastructure. The combination of MFA bypass and virtualization-layer attacks allows for rapid data exfiltration and double-extortion ransomware operations. Organizations are urged to patch CVE-2026-0257 immediately and audit VPN connection logs for unauthorized sessions.