Ransomware operation Settra has joined Qilin in exploiting CVE-2026-0257, an authentication bypass in Palo Alto Networks’ GlobalProtect VPN, according to a ReliaQuest warning posted October 9, 2026. Palo Alto disclosed the flaw on May 13, 2026, with fixes following that month, and CISA added it to its Known Exploited Vulnerabilities catalog on May 29. Five months on, attackers are still finding unpatched gateways.
Rated 7.8 (High) under CVSS v4.0 by the vendor and 9.1 (Critical) by NVD, the bug lets an attacker with no valid credentials open a VPN session — but only on portals or gateways with authentication override cookies enabled and a particular certificate setup. Panorama and Cloud NGFW are not affected.
ReliaQuest says the resulting traffic can pass for ordinary remote work until credential theft, lateral movement, or ransomware is already underway, and has seen Cobalt Strike, BloodHound, and SharpHound follow the initial access. Affected builds sit in PAN-OS 12.1, 11.2, 11.1, and 10.2, plus Prisma Access 11.2 and 10.2. Fixed releases are 12.1.7, 11.2.12, 11.1.15, and 10.2.18-h6 (or the hotfix for your branch), and Prisma Access 11.2.7-h13 and 10.2.10-h36.
Upgrade every portal and gateway together or cookies stop working between them, and expect users to sign in again once. Can’t patch yet? Either disable authentication override cookies or move them to a freshly generated certificate used for nothing else. Then terminate all active GlobalProtect sessions and investigate any you don’t recognize — patching alone won’t evict anyone already inside.
Source: Cybersecurity News
