Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257 (Updated October 19)
Ransomware operators including Spikey Scorpius (aka Qilin) and Tarnished Scorpius (aka Inc) are exploiting PAN-OS vulnerability CVE-2026-0257.
Excerpt from the primary source: Palo Alto Networks Unit 42
Who is affected
Small businesses · Enterprises · Security professionals
Affected technology: PAN-OS / GlobalProtect
Why it matters
CISA lists this as exploited in the wild and known to be used in ransomware campaigns. Unpatched PAN-OS / GlobalProtect systems are exposed to active attacks now.
Automated: stated only from CISA listings and the exploitation evidence in the sources below.
What you should do · Act now
Treat this as an emergency. Identify every system running PAN-OS / GlobalProtect, apply the vendor's fix or published mitigations immediately, and check for signs of compromise. Patching alone does not remove an attacker who already got in.
CISA's required action for CVE-2026-0257: "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable." US federal civilian agencies must comply by June 1, 2026.
Automated guidance based on this story's classification. Check the linked advisories for specifics.
Sources
We link to original and authoritative sources. Headlines and excerpts belong to their publishers.
Related
BeyondTrust Remote Support Zero-Day Continues Trend of Exploited Edge Bugs
Ivanti, Cisco, and Palo Alto Networks all had vulnerabilities in edge devices come under fire this week. Now BeyondTrust joins the group.
There are signs this may already be exploited, which usually shortens the time available to patch.
Palo Alto Networks Patches PAN-OS Zero-Day Exploited for Remote Code Execution
The company says it’s aware of limited exploitation against customers’ firewalls, and it has made IoCs available.
Source reporting says attackers are already exploiting this, so exposed PAN-OS / GlobalProtect systems are at immediate risk.
Treat this as an emergency.
Ahsay AhsayCBS Command Injection Vulnerability (CVE-2026-105134) is being actively exploited, CISA warns
CISA added CVE-2026-105134 (Ahsay AhsayCBS) to its Known Exploited Vulnerabilities catalog on October 14, 2026, which means there is reliable evidence of exploitation in the wild. Ahsay AhsayCBS contains a command injection vulnerability that could allow a remote attacker to execute operating system commands via manipulation of the random parameter in the Replication Receiver component’s…
CISA lists this as exploited in the wild. Unpatched AhsayCBS and Cisco networking & security systems are exposed to active attacks now.
Treat this as an emergency.
Palo Alto Networks PAN-OS Code Injection Vulnerability (CVE-2026-0322) is being actively exploited, CISA warns
CISA added CVE-2026-0322 (Palo Alto Networks PAN-OS) to its Known Exploited Vulnerabilities catalog on October 14, 2026, which means there is reliable evidence of exploitation in the wild. Palo Alto Networks PAN-OS contains a code injection vulnerability that could allow an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall.
CISA lists this as exploited in the wild. Unpatched PAN-OS / GlobalProtect systems are exposed to active attacks now.
Apply the vendor's security update for PAN-OS / GlobalProtect.