Ransomware Actors Exploiting Palo Alto GlobalProtect Flaw for Stealthy VPN Access

What happened?

Ransomware groups are actively exploiting CVE-2026-0257, an authentication bypass affecting Palo Alto Networks PAN-OS GlobalProtect and Prisma Access. ReliaQuest reports that multiple threat groups, including Qilin and Settra, are using the flaw to create unauthorized VPN sessions and enter internal networks through trusted remote access services. The activity presents a serious detection challenge because attackers connect through an organization’s own VPN.

Key details

• Ransomware groups Qilin and Settra exploit CVE-2026-0257 to create unauthorized VPN sessions.
• CVE-2026-0257 allows unauthenticated attacker to bypass security restrictions on GlobalProtect.
• Exploitation requires authentication override cookies and specific certificate configuration.
• Affected PAN-OS versions are 12.1, 11.2, 11.1, and 10.2; Prisma Access 11.2 and 10.2.
• ReliaQuest recommends terminating all active GlobalProtect sessions after patching.
• Vendor warns incomplete upgrades may cause cookie compatibility problems between components.

Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.