URGENTOct 20, 2026Added Oct 20
Unit 42 updated its CVE-2026-0257 threat brief on Oct 19 and again on Oct 20 (1:30 PM PT). Oct 20 addition: during Lunar Peak incident response, Unit 42 repeatedly found GlobalProtect profiles mapped to HTTP/HTTPS services on firewall management interfaces, which unintentionally exposes the management interface to the internet, most often on ports 4443 and 3879. Verify with an out-of-band HTTPS connection to the management IP on those ports and restrict access with Interface Management profiles. Oct 19 update: Spikey Scorpius (Qilin) and Tarnished Scorpius (Inc) are attempting exploitation of the GlobalProtect portal/gateway authentication bypass, and public reporting attributes exploitation to Settra ransomware actors. After bypassing MFA to establish a VPN session, actors use RMM tools for recon, move laterally via RDP and SMB, harvest credentials, exfiltrate data, and deploy ransomware. In one case attackers pivoted from the VPN gateway to vCenter, disabled ESXi execInstalledOnly, and dumped credentials offline from a domain controller's VMDK, bypassing in-guest EDR; Unit 42 also saw chaining with Veeam CVE-2023-27532. On CISA KEV since May 13. Exposure requires auth-override cookies plus a specific certificate configuration. Fixed releases include 12.1.7, 11.2.12, 11.1.15, and 10.2.18-h6 (see advisory). Cloud NGFW and Panorama are not impacted.
Source · unit42.paloaltonetworks.com
URGENTOct 21, 2026Added Oct 25New
UPDATE (Oct 28): On Oct 27, Palo Alto raised the advisory to 9.2 CRITICAL with HIGHEST urgency (from 8.7 HIGH and MODERATE). It now says: "Active exploitation has been observed targeting the Palo Alto Networks management interface exposed to the internet." With jump-box-only management access, the rating is MEDIUM (CVSS-B 7.7). On Oct 28, Palo Alto released 11.2.7-h23, 11.2.13-h4, and 11.2.16-h1. Released so far: 12.2.4-h1, 12.1.7-h11, 11.2.7-h23, 11.2.10-h16, 11.2.13-h4, 11.2.16-h1, 11.1.4-h38, 11.1.6-h40, 11.1.10-h36, 11.1.13-h16, 11.1.16-h4, 10.2.13-h27, 10.2.16-h12, and 10.2.18-h13. Still due: Oct 29 (12.1.4-h13, 10.2.10-h42) and Oct 30 (12.1.10-h3, 11.2.4-h23, 11.1.7-h12, 10.2.7-h39). Unsupported versions must move to a supported fixed version. Only the management web interface (web UI and XML API) on PA-Series, VM-Series, and Panorama is affected, plus any dataplane interface with a management profile. GlobalProtect, Clientless VPN, Captive Portal, Cloud NGFW, and Prisma Access are not affected. CVE-2026-115560 doesn't affect PAN-OS. Mitigate now by restricting management access to trusted internal IPs or a jump box. Frontier Virtual Patching (ATP Plus, 12.2.4 and later) covers it via Threat ID 543004. The Threat Prevention IDs in the advisory protect only when management traffic is routed through a dataplane port, the inbound-management certificate is replaced, that traffic is decrypted, and threat prevention is enabled on it. The same hotfixes also fix the Brotli bug CVE-2026-111497, except 11.2.10-h16. The CISA KEV deadline for PHP2Shell is Oct 29. Hunt with the Unit 42 XQL for NGFW threat logs.
Source · security.paloaltonetworks.com