The investigation expands past the gateway
Palo Alto Networks’ Unit 42 has updated its reporting on exploitation of CVE-2026-0257, identifying ransomware activity involving Qilin and Inc operators. Its October 19 findings describe attackers establishing unauthorized GlobalProtect VPN sessions and moving further into networks. An October 20 update adds management-interface exposure guidance. The reporting is an update on investigations underway since June, not evidence that every affected gateway has suffered a new attack this week.
A server can be attacked from outside its operating system
In one investigated case, Unit 42 says attackers reached vCenter, changed an ESXi security setting and extracted credentials from a domain controller’s virtual disk. That route avoided security controls operating inside the virtual machine. The researchers also observed exploitation involving Veeam backup infrastructure. These are attributed incident-response findings; they do not establish the prevalence of that exact sequence across all customers.
Give the investigation a wider boundary
Our analysis is that teams examining a suspicious VPN session should make an explicit decision about whether the investigation includes the systems that manage their virtual machines. Closing a gateway ticket without involving the virtualization administrator risks leaving the question unanswered. Identify which management interfaces the relevant account or network segment could reach, who can retrieve their logs and whether those records cover the period under review. Preserve the original evidence and document any collection gaps before taking disruptive recovery actions.
Separate service restoration from confidence in the environment
For healthcare organizations, a useful exercise would follow the escalation from the remote-access team to the staff responsible for clinical application infrastructure, with operational leaders approving any interruption. A transportation company could conduct the same exercise around systems supporting dispatch and scheduling. Those scenarios are planning recommendations, not reports of affected patients or transport services. Professional-services firms should similarly identify whether outsourced infrastructure administrators and their security provider can coordinate an investigation without waiting for a new statement of work. The deliverable should explain both which access route has been closed and what evidence supports confidence in the downstream environment. A restored application answers an availability question. It does not automatically settle whether privileged credentials, management systems or recovery resources require further attention. Agreeing on that distinction before an incident can prevent a quick technical fix from becoming an unsupported assurance to leadership.
Sources & further reading
Our practical suggestions are editorial guidance. Verify applicability against current source and vendor instructions.
