Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257 (Updated October 20)
2026-10-20T20:51:32Z•7b75e71d01aa898fe71866ec2d3fe05d7dd6a3ea88e2bdc4a9d6678e9d54518d
CVE-2024-47575CVE-2026-0257CVE-2026-88771CVE-2026-88772FortiGateFortiManagerInc ransomwareKubernetesLinuxNetScalerPAN-OSQilinUnit 42active exploitationcloud securitycredential theftcritical infrastructureedge devicesmacOS malwareransomwaresupply-chain attacksweb shells
What happened
Unit 42 reports active exploitation of PAN-OS CVE-2026-0257 by ransomware operators including Qilin (Spikey Scorpius) and Inc (Tarnished Scorpius). The feed also highlights exploitation of internet-facing edge devices, including FortiGate/FortiManager CVE-2024-47575 and NetScaler CVE-2026-88771/CVE-2026-88772, alongside campaigns involving Linux infrastructure, cloud and Kubernetes environments, supply-chain compromise, credential theft, web shells, and macOS infostealers.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- paloalto_unit42
- Record identifier
- 7b75e71d01aa898fe71866ec2d3fe05d7dd6a3ea88e2bdc4a9d6678e9d54518d
- Enrichment time
- 2026-10-20T20:51:32Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.