Vulnerabilities & Exploits · Ransomware

Qilin and Settra turn Palo Alto VPN into access path

ReliaQuest says Qilin and Settra are actively exploiting CVE-2026-0257 in Palo Alto Networks PAN-OS GlobalProtect and Prisma Access, using the VPN auth bypass to establish unauthorized remote-access sessions. The groups have also been seen alongside Cobalt Strike, BloodHound, and SharpHound, which points to follow-on access and lateral-movement prep.

The bug matters because the entry point is the company’s own remote-access channel: once the gateway accepts the session, the activity can look like a normal employee login. That means patching the appliance does not automatically clear a foothold if the session was already established before remediation.

For any shop that relies on GlobalProtect or Prisma Access, the exposure sits at the trust boundary, not just the device. If an attacker is already inside through VPN, the remaining question is not whether the code is fixed but which live sessions and internal paths still belong to them.

1 source · 1 day ago

Timeline

• Oct 12 Reported by Infosecurity Magazine
• Jun 1 CISA federal deadline for CVE-2026-0257 passed
• May 29 CVE-2026-0257 added to CISA KEV

Sources

• Oct 12 Infosecurity Magazine

  Old Palo Alto VPN Vulnerability Remains a Target for Ransomware Groups

  ReliaQuest confirmed that the Qilin and Settra ransomware groups are actively exploiting a Palo Alto vulnerability patched in May

  original

Vendor digest: Palo Alto Networks

Part of the PlainSec briefing for 2026-10-13

Every edition of this story: Qilin and Settra turn Palo Alto VPN into access path

More from today

• Bricksforge upload flaw turns form files into PHP
• GitLab emergency patch closes a code execution hole
• HPE switch advisory flags management-plane bypasses