Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257 (Updated October 19)
2026-10-20T08:51:31Z•03e48baca60ff246fdc98ebd7380795288132d443ac1fe04b0487606584e7c12
CVE-2024-47575CVE-2026-0257CVE-2026-88771CVE-2026-88772FortiGateFortiManagerInc ransomwareIran-nexus threat actorKubernetesLinux malwareNetScalerPAN-OSPalo Alto NetworksQilinactive exploitationcloud securitycredential theftcritical infrastructureedge devicesmacOS stealerransomwaresupply chain attacksweb shells
What happened
Unit 42 reports active exploitation of PAN-OS CVE-2026-0257 by ransomware operators associated with Qilin (Spikey Scorpius) and Inc (Tarnished Scorpius). The feed also highlights widespread exploitation of edge-device vulnerabilities, including FortiGate/FortiManager CVE-2024-47575 and NetScaler CVE-2026-88771/CVE-2026-88772, alongside campaigns targeting Linux infrastructure, cloud environments, Kubernetes, macOS users and critical infrastructure.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- paloalto_unit42
- Record identifier
- 03e48baca60ff246fdc98ebd7380795288132d443ac1fe04b0487606584e7c12
- Enrichment time
- 2026-10-20T08:51:31Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.