CVE-2026-0257

CVE

Threat entity extracted from intelligence sources

Frequency

occurrences

First Seen

July 1, 2026

Last Seen

October 22, 2026

API

Exploited in Wild

—

Ransomware Use

—

Public Exploits

—

Attack Vector

—

Vulnerability Overview

Exploitation Activity

Exploitation Intelligence

CyberXero Campaign Targets Ukrainian Records Using AI Tools78.7

CyberXero, a Russian-speaking initial access broker, has launched a dual-pronged campaign targeting WordPress sites and Ukrainian critical infrastructure, leveraging AI tools like Claude Code. The operation has led to the exfiltration of over 628,000 records from Ukrainian entities, with confirmed c...

ChocoPoC Malware Targets Cybersecurity Researchers via Trojanized GitHub Exploits74.0

A coordinated supply chain attack has been identified, targeting vulnerability researchers and penetration testers through malicious proof-of-concept (PoC) repositories on GitHub. The malware, named ChocoPoC, is a Python-based remote access trojan (RAT) that stealthily exfiltrates sensitive data. At...

Ransomware Groups Exploit PAN-OS Flaw, Target Critical Infrastructure72.8

Ransomware groups, including Qilin and INC, are exploiting a critical authentication bypass vulnerability (CVE-2026-0257) in Palo Alto Networks' PAN-OS GlobalProtect and Prisma Access. This flaw allows attackers to establish unauthorized VPN sessions, bypassing multifactor authentication controls. S...

Ransomware Groups Exploit Palo Alto VPN Flaw CVE-2026-025770.5

Ransomware groups Qilin and INC are exploiting CVE-2026-0257, a vulnerability in Palo Alto Networks' PAN-OS GlobalProtect VPN, to bypass authentication and gain unauthorized access to corporate networks. Despite a security patch released in May 2026, attackers have been exploiting this flaw since Ju...