Qilin and Settra Reportedly Exploit Palo Alto GlobalProtect Flaw for Unauthorized VPN Access

Ransomware groups including Qilin and Settra are reportedly exploiting CVE-2026-0257, an authentication bypass affecting certain Palo Alto Networks PAN-OS GlobalProtect and Prisma Access configurations, to establish unauthorized VPN sessions. Palo Alto Networks disclosed the high-severity vulnerability on May 13, 2026, with a CVSS score of 7.8. CISA added it to the Known Exploited Vulnerabilities catalog on May 29, confirming exploitation and setting a June 1 remediation deadline for covered federal agencies. Although the catalog entry lists ransomware use as unknown, the newer reporting links exploitation to ransomware operators using legitimate VPN infrastructure to obscure intrusions and enable credential theft, lateral movement, data collection, and ransomware preparation or deployment.

Organizations with affected configurations should apply vendor-directed upgrades across affected components, disable unnecessary authentication override cookies, and use a newly generated certificate dedicated exclusively to those cookies. Patching alone may not eliminate previously established access: remediation also requires terminating existing VPN sessions and investigating potentially compromised access. The KEV entry calls for vendor-directed mitigations, applicable BOD 22-01 guidance for cloud services, or discontinuation of affected products if mitigations are unavailable.