CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

Palo Alto Networks PAN-OS

product · product:palo-alto-networks-pan-os

Coverage
4
first 2026-05-12 → last 2026-10-21
Latest activity
2026-10-21
Qilin and Inc ransomware exploit the GlobalProtect bypass; one intrusion pivoted to vCenter and ESXi past…
Peak priority
high
4 high
Targets
public-sector
sectors: public-sector, finance, healthcare · regions: europe, apac
Sources cited
19
13 hosts

Action items (8)

Do-now tasks recorded on the entries about Palo Alto Networks PAN-OS, newest first. Check the date before acting on an older one.

  • Patch every PAN-OS GlobalProtect portal and gateway to the fixed release in Palo Alto's advisory for its train, or disable authentication override cookies or give them a certificate that no other service uses, then force one re-authentication so override cookies regenerate.
    2026-05-30CVE-2026-0257
  • On every GlobalProtect gateway that was internet-reachable and unpatched at any time since 2026-05-17, treat the network behind it as a ransomware compromise-assessment target: review VPN sessions that authenticated by cookie from unexpected sources, check Windows hosts for the artifacts Arctic Wolf describes (a ransomware payload staged under C:\\PerfLogs, a PsExec service, an LSASS dump written through comsvcs.dll to an .odt file, an ntdsutil media copy of the Active Directory database, and cleared event logs), and extend the assessment to the virtualization and backup tier: vCenter and ESXi audit logs for a changed execInstalledOnly setting and for access to a domain controller's virtual disk, and the Veeam backup server, because Unit 42 describes one intrusion that pivoted from the gateway to vCenter and dumped domain credentials offline, which in-guest EDR does not see.
    2026-05-30CVE-2026-0257
  • Restrict the management interface of every PA-Series, VM-Series and Panorama to a jump box or trusted internal addresses now, then upgrade each to the fixed build of its train (11.2.14 and 11.2.15 units to 11.2.16, published 2026-10-15); there is no workaround.
    2026-10-15CVE-2026-0322
  • On every device whose management interface was reachable from untrusted networks, search management-interface logins, administrator-change records and upstream firewall logs for the three source addresses Palo Alto lists in the advisory's FAQ, and treat a match as a root compromise.
    2026-10-15CVE-2026-0322
  • Confirm every internet-facing NetScaler ADC/Gateway is on 13.1-62.23, 14.1-66.59 or 13.1-FIPS/NDcPP 13.1-37.262 or later, and on any appliance configured as a SAML Identity Provider that ran an earlier build, invalidate existing AAA sessions rather than assuming the patch ended the exposure, the flaw leaks live session material from appliance memory.
    2026-07-31CVE-2026-3055 +2
3 older action items
  • Confirm every marimo notebook instance is on 0.23.0 or later and that none answers from outside the development network, then, separately, compromise-assess any instance that was exposed while below 0.23.0, because Unit 42 records command execution as confirmed on 11 endpoints in this campaign rather than merely attempted, and the patch does not evict an attacker who already had a PTY shell.
    2026-07-31CVE-2026-3055 +2
  • Confirm the April 2026 cumulative update is installed on every Windows host that answers IKEv2 (VPN gateways, Always On VPN endpoints and any domain member running Routing and Remote Access) and treat an unpatched internet-reachable responder as a compromise-assessment candidate rather than a patch backlog item; where a host cannot be patched this cycle, apply Microsoft's stated interim control (block inbound UDP 500/4500 on systems not using IKE, restrict those ports to known peers on systems that do).
    2026-07-31CVE-2026-3055 +2
  • Upgrade every PA-Series and VM-Series firewall with the User-ID Authentication Portal enabled to the fixed build for its branch (for example 12.1.4-h5, 11.2.10-h6, 11.1.13-h5 or 10.2.18-h6, per the advisory table); until then restrict the portal to trusted zones and disable Response Pages on untrusted L3 interfaces, and check any device that was exposed before patching for the Unit 42 post-exploitation behaviours.
    2026-05-12CVE-2026-0300

Defender insights

What each entry about Palo Alto Networks PAN-OS tells a defender to do, newest first.

2026-05-30HIGHexploitedQilin and Inc ransomware exploit the GlobalProtect bypass; one intrusion pivoted to vCenter and ESXi past in-guest EDR

Exposure · detection

2026-10-15HIGHexploitedPalo Alto confirms limited exploitation of a PAN-OS management-interface root flaw; no workaround, 11.2.16 now published

Exposure · detection

2026-07-31HIGHexploitedThe autonomous agent landed nothing; the operator's hand-driven work took data from three NetScaler targets and ran commands on 11 Marimo servers

Latest update · triage · detection

2026-05-12HIGHexploitedA PAN-OS Captive Portal overflow gives unauthenticated attackers root on exposed firewalls; Unit 42 saw tunnelling and AD enumeration afterwards

Exposure · detection

Relationships explore in graph

Typed, source-stated connections from the entity registry; each edge cites the entry whose reporting establishes it.

exploited by

Story timeline

  1. 2026-10-15CVE-2026-0322, Palo Alto Networks PAN-OS: code injection in the management interface gives an authenticated attacker root, exploited in very limited attacks and listed in CISA KEV (CVSS-B 8.6)
    trending-vulnerabilitiesPalo Alto confirms limited exploitation of a PAN-OS management-interface root flaw; no workaround, 11.2.16 now published
  2. 2026-07-31Unit 42 recovers a live autonomous-AI attack operation after it exposed its own home directory, the confirmed compromises came from manual exploitation of Citrix NetScaler (CVE-2026-3055) and Marimo notebooks, not the agent
    active-threatsThe autonomous agent landed nothing; the operator's hand-driven work took data from three NetScaler targets and ran commands on 11 Marimo servers
  3. 2026-05-30CVE-2026-0257, Palo Alto PAN-OS GlobalProtect: pre-auth authentication bypass via certificate reuse, marked by CISA as used in ransomware campaigns
    trending-vulnerabilitiesQilin and Inc ransomware exploit the GlobalProtect bypass; one intrusion pivoted to vCenter and ESXi past in-guest EDR
  4. 2026-05-12CVE-2026-0300: PAN-OS User-ID Authentication Portal unauthenticated root RCE, exploited by a likely state-sponsored cluster; fixed builds for every supported branch
    trending-vulnerabilitiesA PAN-OS Captive Portal overflow gives unauthenticated attackers root on exposed firewalls; Unit 42 saw tunnelling and AD enumeration afterwards

Hunting pivots

CVEs (exploited first)
CVE-2026-0257CVE-2026-0300CVE-2026-0322CVE-2026-3055CVE-2026-33824CVE-2026-39987
Releases covered
Palo Alto Networks PAN-OS ×4
Tags
actively-exploited ×4cisa-kev ×4patch-available ×4vulnerabilities ×4pre-auth ×3rce ×3ai-abuseauth-bypassespionageidentityinfo-disclosureransomware
ATT&CK techniques (28 across 14 tactics)

28 techniques observed across 4 entries about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

  • ReconnaissanceActive Scanning · Active Scanning: Vulnerability Scanning
  • Resource DevelopmentObtain Capabilities: Exploits
  • Initial AccessExternal Remote Services · Exploit Public-Facing Application
  • ExecutionScheduled Task/Job: Scheduled Task · Command and Scripting Interpreter · System Services: Service Execution
  • PersistenceScheduled Task/Job: Scheduled Task · External Remote Services · Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
  • Privilege EscalationScheduled Task/Job: Scheduled Task · Process Injection · Exploitation for Privilege Escalation · Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
  • StealthProcess Injection · Indicator Removal
  • Defense ImpairmentDisable or Modify Tools · Disable or Modify Tools: Clear Windows Event Logs
  • Credential AccessOS Credential Dumping: LSASS Memory · OS Credential Dumping: NTDS · Steal Web Session Cookie
  • DiscoveryAccount Discovery: Domain Account
  • Lateral MovementRemote Services: Remote Desktop Protocol · Remote Services: SMB/Windows Admin Shares
  • Command and ControlProxy · Proxy: Multi-hop Proxy · Web Service · Remote Access Tools · Protocol Tunneling
  • ExfiltrationExfiltration Over Web Service: Exfiltration to Cloud Storage
  • ImpactData Encrypted for Impact · Inhibit System Recovery

Reconnaissance TA0043

T1595Active Scanning×1

Adversaries may execute active reconnaissance scans to gather information that can be used during targeting. Active scans are those where the adversary probes victim infrastructure via network traffic, as opposed to other forms of reconnaissance that do not involve direct interaction.

Evidence: 2026-07-31/unit42-autonomous-deepseek-hermes-netscaler-cve-2026-3055 · ATT&CK page ↗

T1595.002Active Scanning: Vulnerability Scanning×1

Adversaries may scan victims for vulnerabilities that can be used during targeting. Vulnerability scans typically check if the configuration of a target host/application (ex: software and version) potentially aligns with the target of a specific exploit the adversary may seek to use.

Evidence: 2026-07-31/unit42-autonomous-deepseek-hermes-netscaler-cve-2026-3055 · ATT&CK page ↗

Resource Development TA0042

T1588.005Obtain Capabilities: Exploits×1

Adversaries may buy, steal, or download exploits that can be used during targeting. An exploit takes advantage of a bug or vulnerability in order to cause unintended or unanticipated behavior to occur on computer hardware or software. Rather than developing their own exploits, an adversary may find/modify exploits from online or purchase them from exploit vendors.

Evidence: 2026-07-31/unit42-autonomous-deepseek-hermes-netscaler-cve-2026-3055 · ATT&CK page ↗

Initial Access TA0001

T1133External Remote Services×1

Adversaries may leverage external-facing remote services to initially access and/or persist within a network. Remote services such as VPNs, Citrix, and other access mechanisms allow users to connect to internal enterprise network resources from external locations. There are often remote service gateways that manage connections and credential authentication for these services. Services such as Windows Remote Management and VNC can also be used externally.

Evidence: 2026-05-30/cve-2026-0257-palo-alto-pan-os-globalprotect-pre-auth-authen · ATT&CK page ↗

T1190Exploit Public-Facing Application×4

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-10-15/cve-2026-0322-pan-os-management-interface-code-injection · 2026-07-31/unit42-autonomous-deepseek-hermes-netscaler-cve-2026-3055 · 2026-05-30/cve-2026-0257-palo-alto-pan-os-globalprotect-pre-auth-authen · 2026-05-12/palo-alto-pan-os-cve-2026-0300-first-wave-fixed-builds-now-s · ATT&CK page ↗

Execution TA0002

T1053.005Scheduled Task/Job: Scheduled Task×1

Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code. There are multiple ways to access the Task Scheduler in Windows. The schtasks utility can be run directly on the command line, or the Task Scheduler can be opened through the GUI within the Administrator Tools section of the Control Panel. In some cases, adversaries have used a .NET wrapper for the Windows Task Scheduler, and alternatively, adversaries have used the Windows netapi32 library and Windows Management Instrumentation (WMI) to create a scheduled task. Adversaries may also utilize the Powershell Cmdlet `Invoke-CimMethod`, which leverages WMI class `PS_ScheduledTask` to create a scheduled task via an XML path.

Evidence: 2026-05-30/cve-2026-0257-palo-alto-pan-os-globalprotect-pre-auth-authen · ATT&CK page ↗

T1059Command and Scripting Interpreter×1

Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell.

Evidence: 2026-07-31/unit42-autonomous-deepseek-hermes-netscaler-cve-2026-3055 · ATT&CK page ↗

T1569.002System Services: Service Execution×1

Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager (<code>services.exe</code>) is an interface to manage and manipulate services. The service control manager is accessible to users via GUI components as well as system utilities such as <code>sc.exe</code> and Net.

Evidence: 2026-05-30/cve-2026-0257-palo-alto-pan-os-globalprotect-pre-auth-authen · ATT&CK page ↗

Persistence TA0003

T1053.005Scheduled Task/Job: Scheduled Task×1

Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code. There are multiple ways to access the Task Scheduler in Windows. The schtasks utility can be run directly on the command line, or the Task Scheduler can be opened through the GUI within the Administrator Tools section of the Control Panel. In some cases, adversaries have used a .NET wrapper for the Windows Task Scheduler, and alternatively, adversaries have used the Windows netapi32 library and Windows Management Instrumentation (WMI) to create a scheduled task. Adversaries may also utilize the Powershell Cmdlet `Invoke-CimMethod`, which leverages WMI class `PS_ScheduledTask` to create a scheduled task via an XML path.

Evidence: 2026-05-30/cve-2026-0257-palo-alto-pan-os-globalprotect-pre-auth-authen · ATT&CK page ↗

T1133External Remote Services×1

Adversaries may leverage external-facing remote services to initially access and/or persist within a network. Remote services such as VPNs, Citrix, and other access mechanisms allow users to connect to internal enterprise network resources from external locations. There are often remote service gateways that manage connections and credential authentication for these services. Services such as Windows Remote Management and VNC can also be used externally.

Evidence: 2026-05-30/cve-2026-0257-palo-alto-pan-os-globalprotect-pre-auth-authen · ATT&CK page ↗

T1547.001Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder×1

Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.

Evidence: 2026-05-30/cve-2026-0257-palo-alto-pan-os-globalprotect-pre-auth-authen · ATT&CK page ↗

Privilege Escalation TA0004

T1053.005Scheduled Task/Job: Scheduled Task×1

Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code. There are multiple ways to access the Task Scheduler in Windows. The schtasks utility can be run directly on the command line, or the Task Scheduler can be opened through the GUI within the Administrator Tools section of the Control Panel. In some cases, adversaries have used a .NET wrapper for the Windows Task Scheduler, and alternatively, adversaries have used the Windows netapi32 library and Windows Management Instrumentation (WMI) to create a scheduled task. Adversaries may also utilize the Powershell Cmdlet `Invoke-CimMethod`, which leverages WMI class `PS_ScheduledTask` to create a scheduled task via an XML path.

Evidence: 2026-05-30/cve-2026-0257-palo-alto-pan-os-globalprotect-pre-auth-authen · ATT&CK page ↗

T1055Process Injection×1

Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.

Evidence: 2026-05-12/palo-alto-pan-os-cve-2026-0300-first-wave-fixed-builds-now-s · ATT&CK page ↗

T1068Exploitation for Privilege Escalation×1

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.

Evidence: 2026-07-31/unit42-autonomous-deepseek-hermes-netscaler-cve-2026-3055 · ATT&CK page ↗

T1547.001Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder×1

Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.

Evidence: 2026-05-30/cve-2026-0257-palo-alto-pan-os-globalprotect-pre-auth-authen · ATT&CK page ↗

Stealth TA0005

T1055Process Injection×1

Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.

Evidence: 2026-05-12/palo-alto-pan-os-cve-2026-0300-first-wave-fixed-builds-now-s · ATT&CK page ↗

T1070Indicator Removal×1

Adversaries may selectively delete or modify artifacts generated to reduce indications of their presence and blend in with legitimate activity. Rather than broadly removing evidence, adversaries may target specific artifacts that appear anomalous or are likely to draw scrutiny, while leaving sufficient data intact to maintain the appearance of normal system behavior.

Evidence: 2026-05-12/palo-alto-pan-os-cve-2026-0300-first-wave-fixed-builds-now-s · ATT&CK page ↗

Defense Impairment TA0112

T1685Disable or Modify Tools×1

Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities. This may include stopping specific services, killing processes, modifying or deleting tool configuration files and Registry keys, or preventing tools from updating. This may also include impairing defenses more broadly by disrupting preventative, detection, and response mechanisms across host, network, and cloud environments.

Evidence: 2026-05-30/cve-2026-0257-palo-alto-pan-os-globalprotect-pre-auth-authen · ATT&CK page ↗

T1685.005Disable or Modify Tools: Clear Windows Event Logs×1

Adversaries may clear Windows Event Logs to hide the activity of an intrusion. Windows Event Logs are a record of a computer's alerts and notifications. There are three system-defined sources of events: System, Application, and Security, with five event types: Error, Warning, Information, Success Audit, and Failure Audit.

Evidence: 2026-05-30/cve-2026-0257-palo-alto-pan-os-globalprotect-pre-auth-authen · ATT&CK page ↗

Credential Access TA0006

T1003.001OS Credential Dumping: LSASS Memory×1

Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS). After a user logs on, the system generates and stores a variety of credential materials in LSASS process memory. These credential materials can be harvested by an administrative user or SYSTEM and used to conduct Lateral Movement using Use Alternate Authentication Material.

Evidence: 2026-05-30/cve-2026-0257-palo-alto-pan-os-globalprotect-pre-auth-authen · ATT&CK page ↗

T1003.003OS Credential Dumping: NTDS×1

Adversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential information, as well as obtain other information about domain members such as devices, users, and access rights. By default, the NTDS file (NTDS.dit) is located in <code>%SystemRoot%\NTDS\Ntds.dit</code> of a domain controller.

Evidence: 2026-05-30/cve-2026-0257-palo-alto-pan-os-globalprotect-pre-auth-authen · ATT&CK page ↗

T1539Steal Web Session Cookie×1

An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials. Web applications and services often use session cookies as an authentication token after a user has authenticated to a website.

Evidence: 2026-07-31/unit42-autonomous-deepseek-hermes-netscaler-cve-2026-3055 · ATT&CK page ↗

Discovery TA0007

T1087.002Account Discovery: Domain Account×1

Adversaries may attempt to get a listing of domain accounts. This information can help adversaries determine which domain accounts exist to aid in follow-on behavior such as targeting specific accounts which possess particular privileges.

Evidence: 2026-05-12/palo-alto-pan-os-cve-2026-0300-first-wave-fixed-builds-now-s · ATT&CK page ↗

Lateral Movement TA0008

T1021.001Remote Services: Remote Desktop Protocol×1

Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user.

Evidence: 2026-05-30/cve-2026-0257-palo-alto-pan-os-globalprotect-pre-auth-authen · ATT&CK page ↗

T1021.002Remote Services: SMB/Windows Admin Shares×1

Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB). The adversary may then perform actions as the logged-on user.

Evidence: 2026-05-30/cve-2026-0257-palo-alto-pan-os-globalprotect-pre-auth-authen · ATT&CK page ↗

Command and Control TA0011

T1090Proxy×1

Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including HTRAN, ZXProxy, and ZXPortMap. Adversaries use these types of proxies to manage command and control communications, reduce the number of simultaneous outbound network connections, provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between victims to avoid suspicion. Adversaries may chain together multiple proxies to further disguise the source of malicious traffic.

Evidence: 2026-05-12/palo-alto-pan-os-cve-2026-0300-first-wave-fixed-builds-now-s · ATT&CK page ↗

T1090.003Proxy: Multi-hop Proxy×1

Adversaries may chain together multiple proxies to disguise the source of malicious traffic. Typically, a defender will be able to identify the last proxy traffic traversed before it enters their network; the defender may or may not be able to identify any previous proxies before the last-hop proxy. This technique makes identifying the original source of the malicious traffic even more difficult by requiring the defender to trace malicious traffic through several proxies to identify its source.

Evidence: 2026-07-31/unit42-autonomous-deepseek-hermes-netscaler-cve-2026-3055 · ATT&CK page ↗

T1102Web Service×1

Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites, cloud services, and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google, Microsoft, or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.

Evidence: 2026-07-31/unit42-autonomous-deepseek-hermes-netscaler-cve-2026-3055 · ATT&CK page ↗

T1219Remote Access Tools×1

An adversary may use legitimate remote access tools to establish an interactive command and control channel within a network. Remote access tools create a session between two trusted hosts through a graphical interface, a command line interaction, a protocol tunnel via development or management software, or hardware-level access such as KVM (Keyboard, Video, Mouse) over IP solutions. Desktop support software (usually graphical interface) and remote management software (typically command line interface) allow a user to control a computer remotely as if they are a local user inheriting the user or software permissions. This software is commonly used for troubleshooting, software installation, and system management. Adversaries may similarly abuse response features included in EDR and other defensive tools that enable remote access.

Evidence: 2026-05-30/cve-2026-0257-palo-alto-pan-os-globalprotect-pre-auth-authen · ATT&CK page ↗

T1572Protocol Tunneling×1

Adversaries may tunnel network communications to and from a victim system within a separate protocol to avoid detection/network filtering and/or enable access to otherwise unreachable systems. Tunneling involves explicitly encapsulating a protocol within another. This behavior may conceal malicious traffic by blending in with existing traffic and/or provide an outer layer of encryption (similar to a VPN). Tunneling could also enable routing of network packets that would otherwise not reach their intended destination, such as SMB, RDP, or other traffic that would be filtered by network appliances or not routed over the Internet.

Evidence: 2026-05-12/palo-alto-pan-os-cve-2026-0300-first-wave-fixed-builds-now-s · ATT&CK page ↗

Exfiltration TA0010

T1567.002Exfiltration Over Web Service: Exfiltration to Cloud Storage×1

Adversaries may exfiltrate data to a cloud storage service rather than over their primary command and control channel. Cloud storage services allow for the storage, edit, and retrieval of data from a remote cloud storage server over the Internet.

Evidence: 2026-05-30/cve-2026-0257-palo-alto-pan-os-globalprotect-pre-auth-authen · ATT&CK page ↗

Impact TA0040

T1486Data Encrypted for Impact×1

Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.

Evidence: 2026-05-30/cve-2026-0257-palo-alto-pan-os-globalprotect-pre-auth-authen · ATT&CK page ↗

T1490Inhibit System Recovery×1

Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery. This may deny access to available backups and recovery options.

Evidence: 2026-05-30/cve-2026-0257-palo-alto-pan-os-globalprotect-pre-auth-authen · ATT&CK page ↗

Entries about Palo Alto Networks PAN-OS (4)

2026-05-30 · view entry permalink →

HIGHCVE-2026-0257exploitedupdatedNATOA1

CVE-2026-0257, Palo Alto PAN-OS GlobalProtect: pre-auth authentication bypass via certificate reuse, marked by CISA as used in ransomware campaigns

Authentication override cookies in PAN-OS GlobalProtect let a portal or gateway issue a cookie that a user presents in place of re-authenticating, and the feature is not enabled by default (Rapid7, 2026-05-29). Palo Alto Networks says the flaw affects firewalls with a GlobalProtect portal or gateway where authentication override cookies are enabled and a specific certificate configuration exists, classes it as CWE-565 (reliance on cookies without validation and integrity checking), and scores it CVSS 4.0 7.8 with exploit maturity Attacked (Palo Alto Networks PSIRT, 2026-05-13). Rapid7's analysis is that when the certificate used for the cookies is reused for another feature such as the HTTPS service of the portal or gateway, a remote unauthenticated attacker can discover that certificate's public key, forge an arbitrary cookie that the server decrypts and trusts, and bypass authentication; Rapid7 Labs published a proof-of-concept script that tests for it (Rapid7, 2026-05-29). Palo Alto Networks says it is aware of limited exploit attempts on unpatched devices without mitigations applied (Palo Alto Networks PSIRT, 2026-05-13); Rapid7 MDR dates the earliest observed exploitation to 17 May 2026 and saw two waves, on 18 May from Vultr-hosted infrastructure and on 21 May from Dromatics Systems, which it believes are likely the same threat actor because of a consistent MAC address (Rapid7, 2026-05-29). CISA's KEV catalog lists the CVE with a date added of 29 May 2026 (CISA KEV catalog, 2026-10-04).

Affected are PAN-OS 12.1, 11.2, 11.1 and 10.2 releases below the fixed builds in Palo Alto's table and Prisma Access 11.2 and 10.2; Panorama and Cloud NGFW are not affected (Palo Alto Networks PSIRT, 2026-05-13). The solution table names the first fixed build for each minor release, for example 12.1.4-h6 or 12.1.7 and later for 12.1.2 through 12.1.4, 11.2.12 or later for 11.2.11, 11.1.15 or later for 11.1.14, and 10.2.18-h6 or later on the 10.2 train, while Prisma Access 11.2 needs 11.2.7-h13 or later and 10.2 needs 10.2.10-h36 or later (Palo Alto Networks PSIRT, 2026-05-13). After the upgrade users must re-authenticate once, because the firewall regenerates the cookie with a more secure method (Palo Alto Networks PSIRT, 2026-05-13). Palo Alto's mitigations are a dedicated certificate used only for authentication override cookies, or disabling Authentication Override (Palo Alto Networks PSIRT, 2026-05-13).

Palo Alto Networks has become aware of limited exploit attempts on unpatched PAN-OS devices without mitigations applied.

Palo Alto Networks PSIRT

Due to the consistent MAC address, Rapid7 believes both waves of exploitation are likely from the same threat actor (TA).

Rapid7

Arctic Wolf investigated multiple distinct intrusions during June 2026 that resulted in Qilin ransomware deployment, all originating from exploitation of CVE-2026-0257 against Palo Alto Networks firewall appliances.

Arctic Wolf Labs 2026-07-20

Ransomware operators exploiting CVE-2026-0257 include Spikey Scorpius (aka Qilin) and Tarnished Scorpius (aka Inc).

The most significant evolution in tactics, techniques and procedures (TTPs) following successful exploitation of CVE-2026-0257 is the direct pivot to the virtualization layer.

This tactic bypasses in-guest endpoint detection and response (EDR) and security controls, representing a highly sophisticated method for obtaining domain-wide credentials.

Unit 42
Updaterun 2026-06-10-c84347b2actionsevidencesectorssourcesbody

Unit 42's 9 June update on CVE-2026-0257 confirms that a limited number of probed PAN-OS GlobalProtect devices had attacker-established, gateway-connected VPN sessions, moving this from "exploit attempts observed" to confirmed successful exploitation (Unit 42, 2026-06-09). The bug (CWE-565, reliance on a cookie without integrity checking) lets an attacker extract the encryption certificate's public key from the TLS handshake and forge authentication-override cookies when that certificate is shared with another function; Rapid7 dates successful exploitation to 17 May from low-cost hosting IPs (Rapid7, 2026-05-29).

Affected: PAN-OS 10.2/11.1/11.2/12.1 and Prisma Access where authentication override is enabled with a shared certificate; patched in 12.1.7+, 11.2.12+, 11.1.15+, 10.2.18-h6+ and corresponding Prisma builds (Palo Alto Networks, 2026-05-13). Patch, then force one re-authentication so override cookies regenerate; as a workaround disable authentication override or assign it a dedicated certificate. Hunt GlobalProtect gateway logs for cookie-based authentications from unexpected source addresses; Rapid7's log of the attack shows the authentication method recorded as a cookie (Rapid7, 2026-05-29).

Updaterun 2026-06-17-e102009cevidenceregionssectorssourcesbody

Palo Alto's Unit 42 confirms an active exploitation campaign against the GlobalProtect cookie authentication-bypass (CVE-2026-0257) (Unit 42, 2026-06-09). The flaw (CWE-565, reliance on cookies without validation and integrity checking) lets an attacker forge a session and establish a VPN tunnel without credentials when the override feature is enabled (Palo Alto Networks PSIRT).

Arctic Wolf saw exploitation attempts across insurance, finance, manufacturing, education, engineering and healthcare targets in North America and Europe, and in a subset of intrusions automated internal SMB reconnaissance consistent with Impacket tooling (anonymous NTLM logon, share enumeration and domain-user discovery); it says the follow-on activity did not progress substantially beyond the initial SMB session setup and lightweight reconnaissance (Arctic Wolf, 2026-06-11). NCSC-CH refreshed its Security Hub advisory on 2026-06-16 to flag the Unit 42 confirmation (NCSC-CH Security Hub, 2026-06-16). Defenders: disable "Authentication Override" if not required, patch to fixed PAN-OS builds, and audit sessions since 17 May for anonymous NTLM logons and SMB share enumeration from VPN-assigned addresses.

Updaterun 2026-10-06T0405Z-inteltitleheadlinesummarypriorityimmediate_actiontagsentitiestechniquesaffected_productssourcesevidencesourcing_noteclassificationactionsbody

CISA's Known Exploited Vulnerabilities catalog (version 2026.10.04) now marks CVE-2026-0257 as used in known ransomware campaigns; the record names no group and its date of addition remains 2026-05-29 (CISA KEV catalog, 2026-10-04). Arctic Wolf Labs' report of 2026-07-20 says it investigated multiple distinct intrusions in June 2026 that ended in Qilin ransomware deployment, all originating from exploitation of CVE-2026-0257 against Palo Alto Networks firewalls, and that the post-exploitation tradecraft ranged from rapid encryption-only operations to double extortion, possibly suggesting several affiliates of the Qilin ransomware-as-a-service operation (Arctic Wolf, 2026-07-20).

The chain Arctic Wolf describes starts with a GlobalProtect VPN session obtained through the cookie bypass, in some cases from systems that identified themselves as kali, and continues with registry Run-key persistence that points at a ransomware payload staged under C:\PerfLogs, remote-access tools (AnyDesk, Ngrok, LogMeIn and, in one case, a scheduled task consistent with MeshAgent), LSASS credential theft through rundll32 and comsvcs.dll into a file with an .odt extension, a full copy of the Active Directory database with ntdsutil, lateral movement with PsExec over administrative shares and RDP, a PowerShell routine that clears every Windows event log with records, and Microsoft Defender real-time protection disabled in some cases (Arctic Wolf, 2026-07-20). In the double-extortion cases data went to the MEGA cloud storage service with Rclone before encryption, and the attackers targeted the Veeam backup infrastructure before deploying the ransomware; some intrusions involved no data theft before encryption (Arctic Wolf, 2026-07-20). A gateway that was reachable and unpatched therefore needs a compromise assessment of the Windows estate behind it, not only the patch and a forced re-authentication.

Correctionrun 2026-10-11T1307Z-auditbodyevent_date

Arctic Wolf's June telemetry shows automated SMB reconnaissance consistent with Impacket tooling (anonymous NTLM logon, share enumeration, domain-user discovery) in a subset of intrusions, and Arctic Wolf states the activity did not progress substantially beyond the initial SMB session setup and lightweight reconnaissance (Arctic Wolf, 2026-06-11); the 2026-06-17 note had called it lateral movement. Before the Qilin reporting, Rapid7 saw no indication of successful lateral movement from the compromised devices (Rapid7, 2026-05-29), and Unit 42 reported no post-access behavior or lateral movement as of 9 June (Unit 42, 2026-06-09). Rapid7 saw the same spoofed MAC address on the attacker's client in both May waves, a pivot for VPN session logs (Rapid7, 2026-05-29), although Arctic Wolf found MAC spoofing was not consistent across later intrusions (Arctic Wolf, 2026-06-11). Rapid7 Labs published a public proof of concept on 29 May, the same day CISA added the flaw to its catalog (Arctic Wolf, 2026-06-11).

Updaterun 2026-10-21T0256Z-intelheadlinesummaryentitiessourcesevidencesourcing_noteactionsbody

Unit 42 updated its threat brief on 2026-10-19 and 2026-10-20: it continues to see attempted exploitation by ransomware operators, naming Spikey Scorpius (Qilin) and Tarnished Scorpius (Inc), and says it is aware of public reporting that attributes exploitation to actors using Settra ransomware (Unit 42, 2026-10-20). Its investigations have run since early June 2026 and span industries including government (Unit 42, 2026-10-20). The attackers use the flaw for an initial foothold, bypass multi-factor authentication to establish a VPN session, then run reconnaissance with dual-use remote monitoring and management tools, move over RDP and SMB and stage credential harvesting, exfiltration and ransomware (Unit 42, 2026-10-20).

The change Unit 42 stresses is a direct pivot to the virtualization layer: in one case the attackers went from the compromised VPN gateway to the vCenter management appliance, disabled the execInstalledOnly security control on ESXi hosts and used a custom tool for offline credential dumping from a domain controller's virtual disk, which bypasses in-guest EDR; it also saw this access chained with exploit tools aimed at Veeam backup infrastructure (Unit 42, 2026-10-20). The brief adds that GlobalProtect profiles mapped to HTTP or HTTPS services on management interfaces can expose the management interface on ports 4443 and 3879 without the administrators knowing, and that an out-of-band HTTPS connection to the management address on those ports shows whether it is exposed (Unit 42, 2026-10-20). The brief dates the flaw's addition to CISA's catalog to 13 May 2026, whereas the catalog's own record says 29 May 2026 (Unit 42, 2026-10-20; CISA KEV catalog, 2026-10-04).

vulnerability30 May 05:00Zmulti-sourceOpen finding →
Sources: Palo Alto Networks PSIRT · Rapid7 ETR · Unit 42, 2026-06-09 (threat brief, updated 2026-10-19 and 2026-10-20) · Arctic Wolf, 2026-06-11 · NCSC-CH Security Hub, 2026-06-16 · CISA Known Exploited Vulnerabilities catalog · Arctic Wolf Labs

2026-10-15 · view entry permalink →

HIGHCVE-2026-0322exploitedupdatedNATOA2

CVE-2026-0322, Palo Alto Networks PAN-OS: code injection in the management interface gives an authenticated attacker root, exploited in very limited attacks and listed in CISA KEV (CVSS-B 8.6)

Palo Alto Networks' advisory of 2026-10-14 describes CVE-2026-0322, a code injection (CWE-94) in the management interface of PAN-OS that lets an authenticated attacker with network access run arbitrary code as root on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series); Cloud NGFW and Prisma Access are not affected and no special configuration is needed to be affected (Palo Alto Networks PSIRT, 2026-10-14). The advisory is tagged as attacked and says very limited exploitation has been observed targeting the management interface (Palo Alto Networks PSIRT, 2026-10-14), and CISA added the flaw to its Known Exploited Vulnerabilities catalog the same day (CISA, 2026-10-14). Palo Alto scores it CVSS-B 8.6 with a suggested urgency of highest, says the risk is highest when the management interface is reachable from the internet, and scores it 8.5 when access is restricted to a single jump box (Palo Alto Networks PSIRT, 2026-10-14). It lists no workaround; Threat Prevention IDs 510046 and 510047 give limited coverage and only when management traffic is routed through a data-plane interface and decrypted, and Palo Alto warns that variations of the attack may not be detected (Palo Alto Networks PSIRT, 2026-10-14). Fixes ship per train; a unit on 11.2.14 or 11.2.15 had no fixed build when the advisory appeared, and 11.2.16, the fix for those two releases, was published on 2026-10-15 (Palo Alto Networks PSIRT, 2026-10-14). The advisory does not say how the attackers obtained the credentials the flaw requires, when exploitation began or who is behind it, and BleepingComputer says it asked Palo Alto when exploitation began, who is behind the attacks and whether attackers compromised firewalls or used them to reach internal networks (BleepingComputer, 2026-10-14).

Very limited exploitation has been observed targeting the Palo Alto Networks management interface.

No known workarounds exist for this issue.

The risk is highest when you allow access to the management interface from external IP addresses on the internet.

11.2.16 has been published.

Palo Alto Networks PSIRT 2026-10-14
Updaterun 2026-10-16T0256Z-intelheadlinesummarycvesevidenceactionsbody

Palo Alto Networks published 11.2.16 on 2026-10-15, the fixed build for units on 11.2.14 and 11.2.15, which had none when the advisory appeared; its solution table now reads "Upgrade to 11.2.16 or later" for those two releases and every other train keeps the fixed builds already listed (Palo Alto Networks PSIRT, 2026-10-14). The advisory's exploitation status is unchanged at very limited exploitation, and it still lists no workaround (Palo Alto Networks PSIRT, 2026-10-14).

Builds on: Qilin and Inc ransomware exploit the GlobalProtect bypass; one intrusion pivoted to vCenter and…

vulnerability15 Oct 03:41Zmulti-sourceOpen finding →
Sources: Palo Alto Networks PSIRT · BleepingComputer · CISA

2026-07-31 · view entry permalink →

HIGHCVE-2026-3055 +2exploitedupdatedNATOB2

Unit 42 recovers a live autonomous-AI attack operation after it exposed its own home directory, the confirmed compromises came from manual exploitation of Citrix NetScaler (CVE-2026-3055) and Marimo notebooks, not the agent

Palo Alto Unit 42 published an unusually complete reconstruction of a live offensive operation on 2026-07-30, made possible by the operator's own mistake: its agent framework, acting on a command sent over Telegram, started an HTTP file server from the operator's home directory rather than an isolated staging path, exposing AI tool configurations, API keys, exploit scripts, target lists, shell history and the agent's own session logs (Unit 42, 2026-07-30). Unit 42 notes this was out of character; the same operator had emptied exploit directories after use and disabled conversation logging in one of its tools.

The operator, who uses the handles knaithe and KnYuan and describes themselves as a Zhuhai-based binary-security researcher, ran DeepSeek as the reasoning engine behind the open-source Hermes Agent, extended with three capabilities: a framework-bundled jailbreak skill, a custom module for attacking unauthenticated WebSocket endpoints, and a custom procedure that drives internet-wide asset enumeration through a scanning service, wired to a natural-language-to-search-query translator exposed to the agent as a tool.

The result is the part worth reading carefully. Every compromise Unit 42 confirms came from the operator's manual work: data exfiltration from three Citrix NetScaler targets and command execution on 11 Marimo notebook endpoints. Both fully autonomous exploitation attempts failed. Against Langflow, the agent needed either a login-bypass setting enabled or a public flow identifier and found neither; against n8n (which its scanning put at 647,017 instances globally and 25,209 in China) it worked the Chinese slice, sampled about a hundred, probed roughly forty, found three candidates, and was stopped because the unauthenticated form endpoint the exploit chain required was behind authentication on every one. Unit 42's own reading is that the failures were target-side configuration, not defensive detection, and that targets with weaker defaults would have been compromised, a hardening finding rather than a ceiling on the capability. The agent's decision-making is visible in the recovered logs: it abandoned the Langflow target set after assessing the deployment population as too small to be worth the effort and pivoted to a more widely deployed product on its own.

What actually worked was hand-driven. Using CVE-2026-3055, an out-of-bounds memory read in Citrix NetScaler ADC and Gateway, the operator exfiltrated appliance memory from three organisations and searched the recovered bytes for NetScaler authentication cookies, which Unit 42 reads as session-hijacking intent. It describes persistent multi-day targeting of a Malaysian government entity using memory-grooming parameters and maximum read attempts, with the operator returning behind proxy anonymisation on later attempts, behaviour it contrasts with the autonomous campaigns, which hit Chinese domestic infrastructure indiscriminately. Other manual activity included command execution against Marimo notebook instances, deserialization reverse-shell attempts against Tomcat servers and callbacks against Windows IKE VPN endpoints; a cloned PAN-OS exploit was non-functional, carrying placeholder values that cannot achieve code execution, with no evidence of modification or execution found.

The CVE itself deserves separate attention from the AI story, because it is the element with direct constituency exposure. It affects NetScaler ADC and Gateway only when the appliance is configured as a SAML Identity Provider; a precondition Unit 42 does not mention and which comes from the vulnerability record and the vendor's bulletin (Citrix, 2026-03-23). It is KEV-listed, and watchTowr's honeypot network observed exploitation from known threat-actor addresses as of 2026-03-27, months before and unrelated to this operator (watchTowr Labs, 2026-03-29). watchTowr also documents a second overread path under the same CVE reachable through a different endpoint, so an operator validating exposure should not assume a single request signature covers it.

Unit 42 also reports that the operator routed two Western tools, Claude Code and Codex, through a third-party proxy with attribution headers disabled and response storage turned off. It says Claude Code was used only for connectivity testing and proxy validation, its session history holding model checks, connectivity tests and one package-install request across three sessions, and that there were signs of Codex use in exploit-development directories though those chat logs were not preserved, and it relays OpenAI's confirmation that its provider-side safeguards refused the policy-violating requests and that its safety systems flagged and disabled the linked account before Unit 42 shared intelligence. Unit 42's inference is that the operator chose the model with the fewest controls for the autonomous engine precisely because provider-side controls limited the alternatives.

Detection. For the NetScaler exposure the observable is in the appliance's own web logs: repeated requests to the SAML identity-provider endpoints from a single source, returning responses whose length varies request to request, with no corresponding completed authentication; memory-overread harvesting looks like a failing login loop that never fails cleanly. Follow it with authentication telemetry: a session cookie presented from an address or client fingerprint that never performed the sign-in that minted it is the downstream consequence the operator was working toward. More broadly, the enumeration behaviour Unit 42 describes leaves an approach signature worth hunting on any exposed application, high-volume version-fingerprinting requests from a narrow address set, followed within a short window by a small number of precisely-targeted exploit attempts against just the instances whose version replied in scope.

Triage: scanning noise against edge appliances is constant, so volume alone discriminates nothing. Two things separate this from background scanning: the requests target the specific identity-provider paths rather than sweeping the whole surface, and successful reads produce responses that are neither errors nor valid authentication outcomes. On the enumeration side, ordinary vulnerability scanners announce themselves through breadth and user-agent consistency; what Unit 42 describes is narrow, sequenced and selective, a fingerprint pass followed by exploitation of only the matching subset.

The three successful exploitations had memory data exfiltrated through the Citrix NetScaler out-of-bounds memory read vulnerability (CVE-2026-3055). The actor searched the exfiltrated data for NetScaler authentication cookies (NSC_AAAC=), indicating session hijacking intent.

Autonomous AI-driven attack cycles are operationally viable, and the margin of failure was narrow: Exploitation was prevented by target-side configuration requirements, the absence of prerequisite workflow configurations (Langflow) and authentication on form endpoints (n8n). Targets with weaker default configurations would have been susceptible.

Unit 42 (Palo Alto Networks) 2026-07-30

Across all the exploitation attempts, both autonomous and manual, Unit 42 confirmed data exfiltration from three Citrix NetScaler targets (CVE-2026-3055) and command execution on 11 Marimo notebook endpoints (CVE-2026-39987).

Unit 42

This is a pre-authentication double free in ikeext.dll, the module behind the "IKE and AuthIP IPsec Keying Modules" service, which runs as Local System inside a svchost.exe. The flaw is in function IkeReinjectReassembledPacket, on the IKEv2 fragment reassembly path.

We recreated a POC from the official patch, which allowed us to reproduce the issue and create patches

0patch (ACROS Security) 2026-08-05

An unauthenticated attacker could send specially crafted packets to a Windows machine with Internet Key Exchange (IKE) version 2 enabled, which could enable remote code execution.

Microsoft Security Response Center 2026-04-14

Microsoft Internet Key Exchange (IKE) Service Extensions contains a double free vulnerability that could enable remote code execution.

CISA Known Exploited Vulnerabilities catalog

Block inbound traffic on UDP ports 500 and 4500 for systems that do not use IKE.

For systems that require IKE, configure firewall rules to allow inbound traffic on UDP ports 500 and 4500 only from known peer addresses.

Microsoft Security Response Center 2026-04-14
Correctionrun 2026-08-02T1309Z-auditactionsaffected_productscvesevidencetagstechniquesbody

The original entry understated the campaign's confirmed impact, and it did so on the strength of a quotation Unit 42 did not write.

The original entry carried, inside quotation marks and attributed to Unit 42, a sentence reading "Across all the exploitation attempts, both autonomous and manual, Unit 42 was only able to confirm three targets were successfully exploited." Unit 42's actual sentence, at the same point in the post, is "Across all the exploitation attempts, both autonomous and manual, Unit 42 confirmed data exfiltration from three Citrix NetScaler targets (CVE-2026-3055) and command execution on 11 Marimo notebook endpoints (CVE-2026-39987)" (Unit 42, 2026-07-30). The fabricated version dropped the second half of the finding and added a limiting phrase ("was only able to confirm") that carries an editorial judgement the source does not make.

Unit 42's own CVE table is unambiguous on the omitted half: its row for CVE-2026-39987 gives the product as Marimo Notebook, the score as 9.8, the exploitation method as manual, and the status as active exploitation with command execution confirmed. The post's confirmed-impact list runs to four entries rather than one: data exfiltration from three organisations via the Citrix NetScaler flaw, command execution on 11 Marimo notebook instances, Java deserialization reverse-shell attempts against nine Apache Tomcat servers (CVE-2026-34486), and reverse-shell callbacks targeting three IKE VPN endpoints (CVE-2026-33824). Unit 42 also notes it "reviewed evidence of batch exploitation against an unknown number of hosts that were listed in a file deleted by the actor prior to our analysis", so even the enumerated figures are a floor rather than a total.

What survives from the original entry is its central reading of the autonomy question: Unit 42 attributes the confirmed compromises to the operator's manual work, and its table records the manual method against each of the four CVEs above, so the autonomous scanning component still did not itself produce the confirmed intrusions. What does not survive is the impact framing. A reader who took "three confirmed compromises, all NetScaler" from the original entry built the wrong exposure list, and the missing item is the awkward one: Marimo is an open-source reactive Python notebook that data-science and research teams install themselves, so it is far more likely to be absent from a central asset inventory than a NetScaler appliance is.

Triage: the discriminator for a notebook server is lineage rather than the process itself. A Marimo host legitimately spawns Python child processes constantly (that is what a notebook does) so process creation under the notebook service is noise. What is not noise is a child process that is not the interpreter: a shell, a download utility, or a scheduling command spawned by the notebook service account, especially on a host where no interactive session was open at that timestamp. Outbound connections from a notebook server to destinations outside the package-registry and data-source set it normally reaches are the second signal, and the two together (a non-interpreter child plus an unfamiliar egress destination within the same minute) are worth an alert on a host that was internet-reachable during the campaign window.

Updaterun 2026-08-10T0411Z-intelaffected_productscvesevidencesourcestagstechniquesbody

The correction entry on the autonomous-agent intrusion campaign listed four CVEs the operation actually reached, and recorded this one only as "callbacks from three IKE VPN endpoints", an observed effect with no mechanism behind it. 0patch has now published the root cause, which closes that gap (0patch, 2026-08-05).

The analysis places CVE-2026-33824 as "a pre-authentication double free in ikeext.dll, the module behind the 'IKE and AuthIP IPsec Keying Modules' service, which runs as Local System inside a svchost.exe", with the flaw "in function IkeReinjectReassembledPacket, on the IKEv2 fragment reassembly path". An unauthenticated party who can reach UDP 500 or 4500 on a host acting as an IKEv2 responder can free the same heap block twice. 0patch's interest is not offensive (it "recreated a POC from the official patch" by diffing Microsoft's fix, in order to build micropatches for Windows versions no longer receiving official updates) but the consequence is that a working reproduction exists and its derivation is described.

Microsoft's own record corroborates the surrounding facts without endorsing the function-level detail: CWE-415 double free, CVSS 9.8 with a network vector requiring no privileges and no user interaction, released 2026-04-14, and Microsoft's own summary that "An unauthenticated attacker could send specially crafted packets to a Windows machine with Internet Key Exchange (IKE) version 2 enabled, which could enable remote code execution" (Microsoft Security Response Center, 2026-04-14). The affected range spans Windows Server 2016 through Windows Server 2025 and Windows 10 version 1607 through Windows 11 version 26H1 (effectively every supported release at the time) and the vendor records both exploitation and public disclosure as no.

Two qualifications keep this proportionate. The service must be acting as an IKEv2 responder: Microsoft's own wording conditions the attack on IKE version 2 being enabled, so this is not every Windows host on the network, and its stated interim guidance is to block inbound UDP 500 and 4500 where IKE is unused and restrict it to known peers where it is required. And the campaign linkage is the tracked entry's, not 0patch's or Microsoft's; neither source makes any attribution claim, and neither states that the callbacks observed in that campaign resulted from this mechanism.

Detection, telemetry class first. The exploitable surface is a UDP service, so network telemetry is where this lives: inbound sessions to UDP 500 or 4500 from sources outside the configured VPN peer set are the population to look at, and fragmented IKE negotiation traffic from an unrecognised peer is the specific shape, since the flaw sits on the fragment-reassembly path. On the host, the keying service crashing or restarting under svchost is the crash signature, and because the service runs as Local System, any child process descending from that svchost instance is anomalous. Triage: a host that legitimately terminates IPsec tunnels sees fragmented IKE traffic from its real peers constantly, so fragmentation alone is normal; the discriminator is the peer address, and secondarily fragment sequences that never complete a negotiation.

Updaterun 2026-08-19T0410Z-intelactionscvesevidencesectorssourcesbody

The double free in the Windows IKE and AuthIP IPsec Keying Modules service is now catalogued as exploited. CISA added CVE-2026-33824 to its Known Exploited Vulnerabilities catalog on 2026-08-18, recording it as a double free that "could enable remote code execution" (CISA KEV catalog, 2026-08-18), ENISA's EU Vulnerability Database carries the same 2026-08-18 date and an EPSS probability of 0.5585 for its corresponding record (EUVD renders this as the percentage 55.85), though as a mirror of CISA's determination rather than a second assessment of it (ENISA EUVD, 2026-08-18). The prior entry recorded this flaw as patched with exploitation reported as no; that is the part that changed, and it is the only part.

The mechanism and the remediation are unchanged from the earlier coverage: the flaw sits on the IKEv2 fragment-reassembly path, needs no authentication and no user interaction, and yields code execution in the Local System context that hosts the IKEEXT service. What the exploitation confirmation changes is which hosts are in scope, because the vulnerable surface is not only the VPN concentrator, Microsoft's affected list spans Windows Server 2016 through 2025 and Windows 10 v1607 through Windows 11 v26H1, so any domain member that answers IKE, including a Routing and Remote Access role nobody remembers enabling, is a responder (ENISA EUVD, 2026-08-18).

The sourcing split is itself the operationally useful part. Microsoft's record has not been revised since it was published on 14 April 2026, and it still records exploitation as no with an exploitability assessment of "Exploitation Less Likely" (Microsoft Security Response Center, 2026-04-14). Any triage pipeline that ranks Windows CVEs on the vendor's own exploitability field (a common and otherwise reasonable design) has this flaw sitting four months deep in a patch backlog while two cataloguing authorities now class it as exploited. Neither authority publishes the telemetry behind its determination, and neither names an actor, so nothing here supports an attribution.

Detection and hunting concentrate on the service rather than the packet, because the trigger is a malformed fragment sequence that no ordinary log records as anomalous. In process and service telemetry, the signals are unexpected termination, restart or crash-dump generation for the host process running the IKE and AuthIP IPsec Keying Modules service, and any child process created under it, that service should never spawn a command interpreter or a script host. In network telemetry, inbound UDP 500 and 4500 flows from source addresses outside the known VPN peer set are the exposure indicator, and fragmented IKE traffic volumes that do not match the peer population are worth a look. Triage: a legitimate IKEv2 negotiation produces the same port pair and the same fragmentation, so traffic shape alone does not discriminate; what separates suspicious from normal is the source address falling outside the configured peer set, and the correlation of that flow with a service fault or a new child process on the responder. Microsoft's own interim guidance is a firewall control rather than a configuration change: block inbound UDP 500 and 4500 where IKE is unused, and restrict them to known peers where it is required (Microsoft Security Response Center, 2026-04-14).

Correctionrun 2026-09-06T1308Z-auditcvesbody

The EPSS figure quoted twice for CVE-2026-33824 was ENISA's EU Vulnerability Database rendering, which expresses EPSS as a percentage rather than as the probability itself. EUVD's API returns the value multiplied by one hundred, so 55.85 is an exploitation probability of 0.5585 (FIRST.org EPSS API, value as of 2026-08-18). The point the passage makes, that EUVD mirrors CISA's determination rather than assessing it independently, is unaffected.

Correctionrun 2026-09-29T2134Z-audittitlesummaryevidencesourcing_noteheadlinebody

The correction of 2026-08-02 set out that Unit 42 confirmed two manual outcomes, data exfiltration from three Citrix NetScaler targets and command execution on 11 Marimo notebook endpoints (Unit 42, 2026-07-30). Read that way, the confirmed compromises are both sets, three NetScaler exfiltrations and 11 Marimo command executions, not the three NetScaler cases alone. The reading of the autonomy question is unchanged: every confirmed compromise came from the operator's hands, none from the agent.

threat31 Jul 04:09Zmulti-sourceOpen finding →
Sources: Unit 42 (Palo Alto Networks) · Citrix (Cloud Software Group), security bulletin CTX696300 · watchTowr Labs · 0patch (ACROS Security) · Microsoft Security Response Center · CISA Known Exploited Vulnerabilities catalog (feed, version 2026.08.18) · ENISA EU Vulnerability Database

Earlier coverage (1)

2026-05-12HIGHexploitedupdatedNATOA1CVE-2026-0300: PAN-OS User-ID Authentication Portal unauthenticated root RCE, exploited by a likely state-sponsored cluster; fixed builds for every supported branchCVE-2026-0300 (CVSS 4.0 9.3, 8.7 when the portal is restricted to trusted addresses) is a buffer overflow in the PAN-OS User-ID Authentication Portal that gives unauthenticated attackers root on PA-Series and VM-Series firewalls. Unit 42 ties the limited exploitation since April to one likely state-sponsored cluster, CL-STA-1132; CISA lists it as exploited, and fixed builds now exist for every supported branch.

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Vulns3
  • Threats1

Source distribution

  • security.paloaltonetworks.com3 (16%)
  • unit42.paloaltonetworks.com3 (16%)
  • arcticwolf.com2 (11%)
  • cisa.gov2 (11%)
  • 0patch.com1 (5%)
  • api.first.org1 (5%)
  • bleepingcomputer.com1 (5%)
  • euvd.enisa.europa.eu1 (5%)
  • other5 (26%)
All cited sources (19)