CVE-2026-0257: PAN-OS Vulnerability Under Active Exploitation by Qilin and INC Ransomware — Detection and Remediation Guide

Palo Alto Networks Unit 42 has published an updated threat brief confirming active in-the-wild exploitation of CVE-2026-0257, a vulnerability in PAN-OS, by financially motivated encryption-based extortion operators tracked as Spikey Scorpius (aka Qilin) and Tarnished Scorpius (aka INC). This is not theoretical — Unit 42 is observing these groups using the vulnerability as an initial access vector, and the brief was updated as recently as October 19 with new exploitation telemetry.

When ransomware affiliates start burning a firewall vulnerability, the calculus for defenders changes immediately. Your PAN-OS devices are not just perimeter enforcement points — they hold VPN credentials, routing tables, decryption keys, and a privileged vantage point over everything traversing your network. A compromised firewall is a compromised network, full stop. Qilin and INC are both RaaS-affiliate-driven operations with a track record of rapid post-exploitation: lateral movement, credential harvesting, backup destruction, and double extortion. If your edge devices are unpatched, assume you are being scanned right now.

This post gives you a defensive breakdown of the threat, detection content you can deploy today, and a remediation checklist aligned to Palo Alto Networks' advisory.

Technical Analysis

Affected Products and Context

CVE-2026-0257 affects PAN-OS, the operating system running Palo Alto Networks next-generation firewalls (PA-Series hardware, VM-Series virtual firewalls) and Panorama management appliances. Organizations exposing PAN-OS management interfaces or device-facing services to untrusted networks are at the highest risk. Based on the pattern of prior PAN-OS exploitation campaigns, attackers overwhelmingly target internet-reachable interfaces — management interfaces that were never supposed to be internet-facing, and device services exposed through misconfiguration.

Consult the official Palo Alto Networks security advisory for CVE-2026-0257 and the linked PAN-SA advisory for the exact affected version ranges and fixed releases applicable to your deployment (PAN-OS 10.2, 11.1, and 11.2 trains each carry their own fixed maintenance releases). Do not guess at version applicability — pull the advisory table and map it against show system info output from every device you operate.

Threat Actors

• Spikey Scorpius (Qilin): A well-established RaaS operation active since 2022, known for Rust-based encryptors, aggressive affiliate recruitment, and targeting of healthcare, manufacturing, and critical services. Qilin affiliates typically move from initial access to encryption in days, not weeks.
• Tarnished Scorpius (INC): The INC Ransom operation, known for multi-extortion and a growing victim list spanning government and private sector organizations. INC has demonstrated a willingness to acquire access from initial access brokers as well as exploit edge devices directly.

Both groups follow a consistent post-exploitation playbook: establish persistence on or through the compromised edge device, enumerate internal services, harvest credentials (LDAP/AD integration credentials on the firewall are a prime target), pivot to domain infrastructure, stage data for exfiltration, then detonate encryption.

How the Attack Works (Defender's Perspective)

While Unit 42's brief governs the specifics, the observable attack chain for PAN-OS exploitation by ransomware operators follows a recognizable pattern:

1. Reconnaissance and exploitation against an internet-reachable PAN-OS interface. Expect probing of management ports (443/HTTPS to the management interface or GlobalProtect portal) from VPS and bulletproof hosting infrastructure.
2. Arbitrary command execution in the context of the PAN-OS device. Post-exploitation on PAN-OS frequently manifests as unexpected processes spawned by the device's web server or management stack, unauthorized admin sessions, or unexpected configuration changes.
3. Credential and configuration theft. show config running exports, credential scraping, and exfiltration of the device configuration (which can contain LDAP bind credentials, pre-shared keys, and API keys).
4. Persistence and staging. Creation of unauthorized local administrator accounts, scheduled tasks/jobs on the device, or use of the firewall as a tunneling pivot (PAN-OS appliances have full TCP tooling and can be used to relay attacker traffic inward).
5. Hand-off to enterprise intrusion. The firewall foothold is monetized either directly by the exploiting group or sold/transferred, culminating in domain-wide ransomware deployment.

Exploitation Status

Confirmed active exploitation in the wild. Unit 42 is tracking real intrusions attributed to Qilin and INC operators leveraging this CVE. This is the highest urgency classification: treat unpatched, internet-reachable PAN-OS devices as potentially already compromised, not merely vulnerable. Monitor CISA's Known Exploited Vulnerabilities catalog — PAN-OS vulnerabilities under active ransomware exploitation are historically added to KEV with short federal remediation deadlines, and private-sector organizations should hold themselves to the same clock.

Detection & Response

The detections below target the observable behaviors of PAN-OS exploitation and ransomware-operator post-exploitation. A critical caveat from the trenches: your firewall cannot be trusted to report its own compromise. If you are not forwarding PAN-OS logs (traffic, threat, system, config) to an external SIEM, fix that today — it is the single highest-value detection investment for this threat.

Sigma Rules

The following rules focus on high-fidelity behaviors: the PAN-OS device spawning unexpected shell activity, unauthorized configuration and account changes, and suspicious connections to firewall management surfaces. These are tuned for low false-positive rates in production environments.

---
title: PAN-OS Unauthorized Local Administrator Account Creation
id: 3f8a1c92-7d4e-4b2a-9f61-8c3e5a2b9d07
status: experimental
description: Detects creation of new local administrator accounts on PAN-OS devices, a common persistence technique following firewall exploitation by ransomware operators including Qilin and INC.
references:
  - https://unit42.paloaltonetworks.com/active-exploitation-of-pan-os-cve-2026-0257/
  - https://attack.mitre.org/techniques/T1136/
author: Security Arsenal
date: 2026/10/20
tags:
  - attack.persistence
  - attack.t1136
logsource:
  product: paloalto
  service: config
detection:
  selection:
    cmd|contains:
      - 'set mgt-config users'
      - 'set deviceconfig system local-user-database user'
    action: 'set'
  filter_known_admins:
    admin:
      - 'automation-svc'
      - 'panorama-sync'
  condition: selection and not filter_known_admins
falsepositives:
  - Legitimate administrative account provisioning during onboarding
level: high
---
title: PAN-OS Configuration Export or Tech Support File Generation
id: 9b2e4d71-5a3c-4f18-b7d2-6e1a9c4f8b35
status: experimental
description: Detects generation of tech support files or full configuration exports on PAN-OS devices. Ransomware operators exfiltrate device configurations to harvest LDAP bind credentials, pre-shared keys, and network topology.
references:
  - https://unit42.paloaltonetworks.com/active-exploitation-of-pan-os-cve-2026-0257/
  - https://attack.mitre.org/techniques/T1602/
author: Security Arsenal
date: 2026/10/20
tags:
  - attack.collection
  - attack.t1602
  - attack.t1005
logsource:
  product: paloalto
  service: system
detection:
  selection:
    - cmd|contains:
        - 'request tech-support-file'
        - 'scp export configuration'
        - 'tftp export configuration'
        - 'export config'
    - eventid: 'general'
      description|contains:
        - 'tech-support'
        - 'configuration export'
  condition: selection
falsepositives:
  - Scheduled backup automation (whitelist known backup service accounts and source IPs)
  - Support case troubleshooting by authorized engineers
level: medium
---
title: PAN-OS Management Interface Login from Untrusted Source
id: 5c7f2a84-1e9b-4d63-a8c1-2f6e8b3d7a49
status: experimental
description: Detects successful administrative logins to PAN-OS management or GlobalProtect interfaces from external or non-bastion source addresses. Firewall management should only ever be reachable from dedicated management networks or jump hosts.
references:
  - https://unit42.paloaltonetworks.com/active-exploitation-of-pan-os-cve-2026-0257/
  - https://attack.mitre.org/techniques/T1078/
author: Security Arsenal
date: 2026/10/20
tags:
  - attack.initial_access
  - attack.t1078
  - attack.t1190
logsource:
  product: paloalto
  service: system
detection:
  selection:
    eventid: 'general'
    description|contains:
      - 'User authenticated'
      - 'login success'
      - 'Admin login successful'
  filter_bastion:
    src|cidr:
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
  condition: selection and not filter_bastion
falsepositives:
  - Misconfigured management ACLs (which themselves must be remediated immediately)
  - MSP/NOC access — whitelist documented source IPs only after verification
level: critical

Tuning note: Replace the placeholder RFC1918 CIDRs in rule three with your actual bastion/jump-host ranges, and the service account names in rule one with your environment's automation accounts. The goal is that any alert from these rules warrants a human response.

KQL Hunting Query (Microsoft Sentinel)

This query hunts PAN-OS syslogs ingested via CEF/Syslog into Sentinel for the exploitation and post-exploitation indicators described above: admin logins from unusual sources, config exports, account creation, and repeated authentication failures that precede or accompany exploitation.

// Hunt: PAN-OS exploitation and post-exploitation indicators (CVE-2026-0257 campaign)
// Ingest PAN-OS System/Config logs via CEF or Syslog connector
let Lookback = 14d;
union isfuzzy=true
  (CommonSecurityLog
   | where TimeGenerated > ago(Lookback)
   | where DeviceVendor =~ "Palo Alto Networks"
   | extend LogMessage = coalesce(Message, AdditionalExtensions)
   | where LogMessage has_any ("tech-support", "export configuration", "set mgt-config users", "login success", "User authenticated")
      or Activity has_any ("general", "config")
   | project TimeGenerated, DeviceName, SourceIP, DestinationIP, Activity, LogMessage, DeviceProduct),
  (Syslog
   | where TimeGenerated > ago(Lookback)
   | where Computer has_any ("panorama", "pa-", "fw-") or Facility =~ "local4" or ProcessName has_any ("configd", "mgmtsrvr", "devsrvr")
   | where SyslogMessage has_any ("tech-support", "export configuration", "set mgt-config users", "login success", "User authenticated", "failed login")
   | project TimeGenerated, Computer, HostIP, ProcessName, SyslogMessage, SeverityLevel)
| extend IndicatorType = case(
    LogMessage has "tech-support" or SyslogMessage has "tech-support", "Config/Tech-Support Export",
    LogMessage has "set mgt-config users" or SyslogMessage has "set mgt-config users", "Local Admin Account Change",
    LogMessage has "login success" or SyslogMessage has "login success", "Admin Login",
    "Authentication Failure")
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), EventCount=count(),
            SampleMessages=make_set(strcat(coalesce(LogMessage, SyslogMessage)), 3)
  by IndicatorType, coalesce(DeviceName, Computer), coalesce(SourceIP, HostIP)
| order by EventCount desc;

Run this daily during the exposure window, and pivot on any source IP that appears in both "Authentication Failure" bursts and subsequent "Admin Login" events — that sequence is a classic pre- and post-exploitation signature.

Velociraptor VQL

PAN-OS is a closed appliance platform, so Velociraptor cannot run on the firewall itself. Where VQL delivers value in this campaign is hunting the internal endpoints for evidence of pivot activity originating from the firewall's IP address — because a compromised PAN-OS device is an attacker-controlled host inside your perimeter. Deploy this artifact across your fleet with your firewall management/data-plane IPs substituted:

-- Hunt: Endpoint network connections originating from PAN-OS firewall IP addresses
-- A compromised firewall will initiate inbound connections to internal hosts (SMB, WinRM, RDP, SSH)
-- Replace the IP list with your actual PAN-OS device addresses
LET fw_ips <= ('10.1.1.1', '10.1.1.2', '192.168.100.1')

SELECT Pid, Name, Path, Family, Type, Status,
       Laddr.IP AS LocalIP, Laddr.Port AS LocalPort,
       Raddr.IP AS RemoteIP, Raddr.Port AS RemotePort,
       timestamp(epoch=now()) AS CollectionTime
FROM netstat()
WHERE (RemoteIP in fw_ips OR LocalIP in fw_ips)
  AND (RemotePort in (22, 135, 139, 445, 3389, 5985, 5986)
       OR LocalPort in (22, 135, 139, 445, 3389, 5985, 5986))

Any hit on this hunt is high-fidelity: your firewalls should never be initiating SMB, RDP, or WinRM sessions to internal endpoints. Pair this with a follow-on VQL collection of authentication event logs on any endpoint that appears in the results to reconstruct lateral movement.

Remediation and Verification Script

The following Bash script uses the PAN-OS XML API to pull version information across your device inventory and flag whether each device is running a release below the fixed version for its train. Update FIXED_VERSIONS with the exact fixed releases from the Palo Alto Networks advisory before running, and use a read-only API key where possible.

#!/bin/bash
# PAN-OS CVE-2026-0257 version verification across device inventory
# Requires: curl, jq, a PAN-OS API key (read-only is sufficient)
# Usage: ./panos_cve_2026_0257_check.sh devices.txt

API_KEY="YOUR_API_KEY_HERE"
DEVICE_LIST="${1:-devices.txt}"   # one firewall mgmt IP/FQDN per line

# REPLACE with the fixed versions from the official PAN-SA advisory for CVE-2026-0257
FIXED_VERSIONS=("10.2.XX-hX" "11.1.XX-hX" "11.2.XX")

is_fixed() {
  local ver="$1"
  for fixed in "${FIXED_VERSIONS[@]}"; do
    [[ "$ver" == "$fixed"* ]] && return 0
  done
  return 1
}

while read -r FW; do
  [[ -z "$FW" || "$FW" == \#* ]] && continue
  echo "[*] Querying $FW ..."
  RESP=$(curl -sk --max-time 15 \
    "https://${FW}/api/?type=op&cmd=<show><system><info></info></system></show>&key=${API_KEY}")
  if [[ -z "$RESP" ]]; then
    echo "[!] $FW : UNREACHABLE — verify manually"
    continue
  fi
  MODEL=$(echo "$RESP" | grep -oP '(?<=<model>)[^<]+')
  VERSION=$(echo "$RESP" | grep -oP '(?<=<sw-version>)[^<]+')
  SERIAL=$(echo "$RESP" | grep -oP '(?<=<serial>)[^<]+')
  if is_fixed "$VERSION"; then
    echo "[OK]  $FW ($MODEL, $SERIAL) — PAN-OS $VERSION : patched train"
  else
    echo "[VULN] $FW ($MODEL, $SERIAL) — PAN-OS $VERSION : NOT on a fixed release — escalate"
  fi
done < "$DEVICE_LIST"

echo ""
echo "=== Post-patch verification checklist (run manually per device) ==="
echo "1. Audit local admin accounts:  show admins local"
echo "2. Review auth logs for anomalies:  show log system direction equal backward"
echo "3. Verify management interface is NOT internet-reachable:  show interface management"
echo "4. Confirm log forwarding to external SIEM is active:  show log-forwarding status"
echo "5. Rotate LDAP bind creds, API keys, and pre-shared keys IF compromise is suspected"

Remediation

Treat this as an emergency change, not a scheduled maintenance item. Recommended sequence:

1. Patch immediately. Upgrade PAN-OS and Panorama to the fixed releases specified in the Palo Alto Networks security advisory referenced by Unit 42. Follow the advisory's train-specific guidance (10.2, 11.1, 11.2) — do not assume the latest minor release of your train includes the fix without confirming against the advisory table. If your devices fall under CISA KEV once added, align to the published federal remediation deadline; regardless of KEV status, our guidance to clients is 72 hours maximum for internet-reachable devices under active ransomware exploitation.

2. Remove management interfaces from the internet — permanently. Whether or not you are patched today, internet-exposed PAN-OS management is an architectural defect, not a configuration nuance. Restrict management access to a dedicated management VRF/subnet reachable only via hardened jump hosts with MFA. Palo Alto Networks has repeatedly published this guidance; every PAN-OS exploitation campaign in recent years has fed on organizations that ignored it.

3. Hunt before and after patching. Patching closes the door; it does not evict anyone already inside. Deploy the detections above, review at least 30 days of historical auth/config/system logs (longer if your retention allows), and scrutinize any local admin accounts, scheduled jobs, or configuration exports you cannot attribute to a change ticket.

4. Rotate credentials on any device with exposure or suspicious history. This includes LDAP/AD bind accounts (often over-privileged domain accounts), API keys, GlobalProtect pre-shared keys, and local admin credentials. If Qilin or INC operators touched the device, assume everything stored on it is known to them.

5. Verify log forwarding integrity. Confirm traffic, threat, system, and config logs are flowing to an external, access-controlled SIEM. An attacker with firewall access can clear local logs; they cannot reach your Sentinel workspace or Splunk indexer.

6. Brief your IR retainer and review ransomware playbooks. Given the actors involved, a confirmed compromise of a PAN-OS device should be treated as the opening move of a full enterprise ransomware event. Activate your incident response plan at the first credible indicator — do not wait for encryption to confirm the diagnosis.

The Bottom Line

CVE-2026-0257 joins the growing list of edge-device vulnerabilities that ransomware groups have industrialized into an initial access pipeline. Qilin and INC operators are not researching this bug in a lab — they are using it against real networks today. The organizations that survive these campaigns are the ones that patch in hours, never expose management planes to the internet, forward logs off-box, and hunt for compromise instead of assuming the patch was enough. Check your version, lock down your interfaces, and start hunting.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub