Ransomware Groups Actively Exploiting PAN-OS Vulnerability CVE-2026-0257

Palo Alto Networks' Unit 42 threat intelligence team has confirmed that CVE-2026-0257, a vulnerability in PAN-OS, is being actively exploited by ransomware operators. Two distinct groups, Spikey Scorpius (Qilin) and Tarnished Scorpius (Inc.), are involved, with a history of targeting UK organizations across various sectors.