WORLD WATCH · October 19, 2026 · RESEARCH
Active exploitation of PAN-OS CVE-2026-0257
Ransomware operators exploit PAN-OS vulnerability CVE-2026-0257.
- Reported by
- Unit 42, Malware News
- Outlets reporting
- 2
- Category
- RESEARCH
- Identifiers
- CVE-2026-0257
- Newest report
- October 19, 2026
Plain-English brief. Written for readers who work in a second language.
Key takeaways
- Spikey Scorpius exploits PAN-OS CVE-2026-0257
- Tarnished Scorpius exploits PAN-OS CVE-2026-0257
- Two ransomware operators use the same vulnerability
What happened
The report comes from Unit 42.
Spikey Scorpius, also known as Qilin, exploits PAN-OS CVE-2026-0257.
Tarnished Scorpius, also known as Inc, exploits PAN-OS CVE-2026-0257.
Malware News notes a threat intelligence report for 19th October that includes this item.
Why it matters
Two separate ransomware operators use exploitation of PAN-OS CVE-2026-0257.
That use indicates active exploitation of that vulnerability by ransomware operators.
What to do
- Verify exposure to PAN-OS CVE-2026-0257 in affected systems.
- Track known indicators for Spikey Scorpius activity.
- Track known indicators for Tarnished Scorpius activity.
SOURCE: INTEL128 WORLD WATCH (UPDATED OCT 20, 2026). This brief summarizes reporting by Unit 42, Malware News. Intel128 writes the summary and credits the outlet. Read the summary as a starting point, not as a substitute for the original reporting.