The firewall is the thing you point at the auditor when they ask how you keep ransomware out of the network. So there’s a particular flavour of dread in Unit 42’s October 19 update: the PAN-OS box itself is the initial access vector, and two ransomware crews are already through it.
The bug is CVE-2026-0257, in PAN-OS. Unit 42 has confirmed active exploitation by Spikey Scorpius — the operation behind Qilin — and Tarnished Scorpius, who run Inc. These are not researchers poking at a lab. They are two established extortion operations using a perimeter device as the way in, then doing what they always do: credential theft, lateral movement, domain takeover, encryption, and a note asking for money. Initial access through the firewall collapses the whole timeline. You skip the phishing email and the dwell time and go straight to someone holding your file servers.
Check the affected and fixed versions in the official Palo Alto Networks security advisory for CVE-2026-0257 before you do anything else — that advisory is the only source that will tell you the exact maintenance releases that close the hole in your branch. Don’t take a version number from a blog, including this one. Palo Alto publishes fixed builds per supported branch; match your running version against the one for your branch, not the newest shiny release.
First, know what you’re running. From the CLI:
If you’d rather pull it across a fleet from a management host via the XML API — read-only, nothing changes:
Compare each result against the advisory’s fixed version for that branch. Anything behind it is in the blast radius.
While you’re in there, answer the question that actually decides how bad your night is: can the internet reach the management plane? The historically expensive PAN-OS incidents have one thing in common — a management interface or admin service exposed to the world. Confirm your permitted-IP list is populated and tight:
If that comes back empty, or with 0.0.0.0/0, you have a second problem on top of the CVE.
The remediation order is boring and correct. Patch to the fixed release for your branch tonight — this is a patch-out-of-cycle event, not a next-maintenance-window event. Active exploitation plus ransomware plus a perimeter device is the exact combination the change advisory board exists to make an exception for. If you genuinely cannot patch in the next few hours, buy yourself time by restricting the management interface to a jump host or management VLAN only, disabling internet-facing admin access entirely, and checking whether your branch has a vendor-supplied workaround listed in the advisory. These are tourniquets, not fixes. Patch anyway.
Then assume you may already be behind. Pull your management-plane logs and look for admin sessions, config changes and new accounts you can’t account for in the days before you read this. Qilin and Inc move fast once they’re in, so an unexplained administrative action is a reason to open an incident, not to shrug. A patched firewall with a quietly added admin account is not a patched firewall.
The uncomfortable part is the symmetry. You bought the device to stop this exact outcome, and for the duration of this bug it was handing out the keys. Patch it before someone else finishes reading the same advisory you just did.