Palo Alto VPN flaw CVE-2026-0257 still exploited by Qilin and Settra

ReliaQuest warns that the Qilin and Settra ransomware groups are still exploiting CVE-2026-0257, an authentication bypass in PAN-OS GlobalProtect and Prisma Access, to gain initial access to internal networks. The patch was released on May 13, 2026, but many devices remain unpatched.

• CVE-2026-0257 is an authentication bypass in PAN-OS GlobalProtect and Prisma Access rated CVSS 7.8
• Affected: PAN-OS 10.2.0, 11.1.0, 11.2.0, 12.1.0, Cloud NGFW and Prisma Access 10.2.0/11.2.0
• Qilin and Settra deploy Cobalt Strike, BloodHound and SharpHound after gaining access
• ReliaQuest assesses further exploitation attempts as highly likely over the next three months