From VPN Gateway to Hypervisor: How Ransomware Crews Are Turning a Months-Old Palo Alto Flaw Into Domain-Wide Access
A Palo Alto Networks authentication bypass patched in May is still opening doors for ransomware groups, who use it to set up VPN sessions without passing MFA and then jump straight to the virtualization layer. Here is the timeline, the technique, and a hardening list.
Patched is not the same as safe if the patch never got installed. Palo Alto Networks’ Unit 42 team said on Monday it is still seeing ransomware groups exploit CVE-2026-0257, an authentication bypass in PAN-OS and Prisma Access that the company fixed in May. What makes the update notable is not the entry point but where attackers go next.
Our summary is based on The Hacker News’ report on the Unit 42 update. This is a different flaw from the management-interface zero-day we covered on October 15.
How the story built up
- May 2026: Palo Alto Networks patches CVE-2026-0257, rated 7.8 on the CVSS scale, which can be abused to set up unauthorized VPN connections.
- May 13, 2026: CISA adds it to its Known Exploited Vulnerabilities catalog.
- July 2026: Arctic Wolf flags the Qilin ransomware group exploiting it, in attacks ranging from quick encryption-only hits to full double extortion.
- Days before Unit 42’s update: ReliaQuest reports Qilin and the Settra ransomware group actively exploiting the flaw.
- Monday, October 19: Unit 42 names Qilin (which it tracks as Spikey Scorpius) and INC (Tarnished Scorpius) and describes how the intrusions unfold.
The technique, step by step
1. A VPN session without the second factor
The attackers exploit the flaw to get a foothold and get around multifactor authentication, ending up with a working VPN session into the corporate network.
2. Quiet reconnaissance
Once connected, they map the network with remote monitoring and management tools, the same kind of software IT teams use every day.
3. Lateral movement
They spread using Remote Desktop and Windows file sharing (SMB), then stage tools for stealing credentials and data and for deploying ransomware.
4. The hop to the hypervisor
Unit 42 calls this the biggest change in tactics. In one case the attackers went from the compromised VPN gateway to the vCenter management appliance, turned off a security control on the ESXi hosts (the execInstalledOnly setting, which restricts the hosts to running installed, approved code), and used a custom tool to pull credentials directly from a domain controller’s virtual disk file while it sat offline. Working underneath the guest operating system sidesteps the endpoint detection running inside it and yields credentials for the whole domain.
5. Going after backups
Attackers have also chained this access with exploits for known flaws in Veeam backup infrastructure, including CVE-2023-27532, to maximize damage.
Targets span education, finance, healthcare, technology, hospitality, manufacturing, professional and legal services, government, transportation, utilities and energy, and retail.
A hardening list for the layers this attack crosses
- Confirm the patch. Check every PAN-OS firewall and Prisma Access deployment against Palo Alto’s advisory for CVE-2026-0257.
- Hunt anyway. Palo Alto recommends proactively looking for signs of compromise and starting incident response if you find suspicious successful gateway connections. A patch applied after a break-in does not remove the intruder.
- Fence off virtualization management. vCenter and ESXi management interfaces should be reachable only from a dedicated admin network, not from VPN user address pools.
- Treat hypervisor settings as security controls. Alert when protections such as execInstalledOnly are changed, and use separate credentials for virtualization admins.
- Watch remote management tools. Know which RMM products are approved in your environment so an unexpected one stands out.
- Protect the backup server. Patch backup software, keep its console off the general network and maintain an offline or immutable copy.
What this means for your company
Many small and mid-size businesses run a single firewall that also serves as the VPN, plus a handful of virtual servers on one or two hosts. That compact setup is exactly what this playbook exploits: once the VPN falls, the path to the hypervisor and the backups can be short. If you run Palo Alto gear, verify the May fix and review recent VPN logins this week. Whatever brand you use, ask whether a VPN user could ever reach your virtualization console. If the answer is yes, close that path.
Need help verifying your firewall patches, reviewing VPN logs or separating your virtualization management from the rest of the network? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
