Ransomware Groups Actively Exploiting PAN-OS Vulnerability CVE-2026-0257

Palo Alto Networks' Unit 42 threat intelligence team has published an updated threat brief confirming that CVE-2026-0257, a vulnerability in PAN-OS, is being actively exploited by ransomware operators. Two distinct groups have been identified: Spikey Scorpius, also known as Qilin, and Tarnished Scorpius, also known as Inc. Both groups have a documented history of targeting UK organisations across sectors including healthcare, education, legal services and professional services. The Unit 42 advisory was updated on 19 October 2026, indicating that exploitation activity is ongoing and that the threat brief reflects the most current intelligence available.

Why this matters for UK organisations

PAN-OS is the operating system that underpins Palo Alto Networks firewalls and network security appliances, which are widely deployed in UK enterprise environments as perimeter and internal security controls. When a network security device is itself compromised, the consequences extend well beyond a single system. Attackers who gain access through a vulnerable firewall can achieve a privileged network position, potentially bypassing detection controls, intercepting traffic, moving laterally across the environment and establishing persistence before deploying ransomware or exfiltrating data. The involvement of two established ransomware groups signals that this vulnerability has moved beyond opportunistic scanning into active, targeted intrusion campaigns.

Both Qilin and Inc have been linked to attacks on UK organisations in recent periods, and their continued activity underlines that UK businesses remain firmly within scope for ransomware operators. Organisations in sectors with sensitive data — healthcare, legal, education and financial services — should treat this advisory with particular urgency.

What to review

UK organisations using Palo Alto Networks PAN-OS appliances should immediately confirm whether CVE-2026-0257 has been patched and, if not, prioritise remediation. Firewall and network logs should be reviewed for indicators of compromise consistent with the activity described in the Unit 42 advisory. Given the active involvement of ransomware operators, this is also a timely prompt to verify that backups are current, have been tested for restoration, and are stored in a location that is isolated from the main network. Incident response plans should be reviewed to ensure that the right contacts, escalation paths and communication procedures are in place if a compromise is identified.

Source: Palo Alto Unit 42