Palo Alto CVE-2026-0257 Still Used for Ransomware VPN Access
GlobalProtect authentication bypass used by Qilin and Settra

Palo Alto CVE-2026-0257 Still Used for Ransomware VPN Access

Ransomware crews are still walking in through a Palo Alto GlobalProtect authentication bypass that was patched in May. The sessions look like ordinary VPN traffic until credential theft or encryption starts.

What happened

Infosecurity Magazine reported on 12 October that ReliaQuest has confirmed Qilin and Settra are exploiting CVE-2026-0257 to establish unauthorized VPN sessions. ReliaQuest posted the advisory on 9 October and said continued exploitation over the next three months is highly likely.

Palo Alto disclosed the flaw on 13 May 2026, scored it 7.8, and rated urgency highest. NVD later scored it 9.1. CISA added it to the Known Exploited Vulnerabilities catalog on 29 May, with a federal due date of 1 June. Rapid7, Unit 42, and Arctic Wolf had already reported exploit attempts before this latest ransomware confirmation.

ReliaQuest also observed Cobalt Strike, BloodHound, and SharpHound alongside the VPN access. The bypass depends on configuration: authentication override cookies must be enabled with a specific certificate setup. Panorama and Cloud NGFW are not affected.

Who is affected

  • Unpatched PAN-OS GlobalProtect portals and gateways on the 10.2, 11.1, 11.2, and 12.1 branches, where authentication override cookies are enabled.
  • Affected Prisma Access 10.2 and 11.2 deployments that have not reached the fixed builds.
  • Networks that patched late. Access created before the upgrade is not removed by the patch alone.

What to do now

Upgrade to the fixed maintenance release for your exact branch, disable authentication override cookies if you do not need them, and terminate every active GlobalProtect session after the change.

Then hunt unexpected VPN sessions, including connections that present a hostname such as kali. Compare your build to Palo Alto's fixed-version table rather than assuming a major version is safe. Investigate credential theft and lateral movement even if the gateway now shows as patched.

Source: Infosecurity Magazine, 12 October 2026. Months-Old Palo Alto VPN Vulnerability Remains a Target for Ransomware Groups.

Also on the blog

Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.

SonicWall SMA1000 CVE-2026-102255 CVSS 10 SSRF Under Attack
unauthenticated Work Place SSRF on SMA 6210 7210 8200v