Three separate ransomware operators are now using the same PAN-OS vulnerability as a routine entry point. Unit 42 confirmed on October 24, 2026 that Spikey Scorpius, Tarnished Scorpius, and Settra -- three distinct criminal groups with no apparent coordination -- are all exploiting CVE-2026-0257, a GlobalProtect authentication bypass, to get past MFA and into enterprise networks. Active exploitation has been ongoing since June 2026.
The vulnerability
CVE-2026-0257 is an authentication bypass in Palo Alto Networks GlobalProtect, the VPN gateway component built into PAN-OS. An attacker with network access to the GlobalProtect portal can bypass multi-factor authentication requirements and authenticate as any valid user. Palo Alto issued a fix in Palo Alto Security Advisory PAN-SA-2026-0005 earlier in 2026. The fix is available; the problem is that large enterprise GlobalProtect deployments have substantial patch lag due to change-control processes and maintenance window constraints.
Three operators, one entry point
Unit 42's confirmation that Spikey Scorpius, Tarnished Scorpius, and Settra are all exploiting the same vulnerability signals that CVE-2026-0257 has crossed from targeted-attacker use into commodity status. In security operations terminology, a commodity exploit is one that any moderately capable criminal group can operationalize without specialized knowledge -- typically because exploitation tooling has been shared or sold on criminal forums. The presence of three named operators with no apparent coordination is strong evidence for commodity status. This means the population of attackers with the capability to exploit this vulnerability just expanded significantly from the group that first weaponized it.
What commodity status means for your exposure
When a vulnerability reaches commodity status, threat models that assumed sophisticated-attacker targeting no longer apply. An organization that maintained GlobalProtect without patching because it was not a named target of Spikey Scorpius or similar groups should now assume it is a potential target. Commodity exploits get used opportunistically at scale: automated scanners identify exposed GlobalProtect portals and the exploit runs against any reachable instance. The relevant question is no longer whether you are targeted but whether you are reachable.
Immediate actions
Apply the patch documented in PAN-SA-2026-0005 to all GlobalProtect deployments immediately. If emergency patching is not possible, check for lateral movement indicators from June 2026 onward -- Unit 42 confirmed that exploitation has been active since then. IOCs are available in the Unit 42 report. In the interim, restrict access to the GlobalProtect portal to known IP ranges where operationally feasible. Review authentication logs for anomalous authentication patterns in the June to October window.
Gigia Tsiklauri is the founder of infosec.ge. Get in touch to report a vulnerability, submit a tip, or ask about coverage.