Qilin and Settra ransomware exploit Palo Alto GlobalProtect flaw CVE-2026-0257

Security firm ReliaQuest published an update to its analysis of vulnerability CVE-2026-0257 on October 11, 2026. According to the company, the Qilin and Settra ransomware groups are using it to open unauthorized VPN sessions, then move through their victims' networks. The flaw allows attackers to bypass authentication on GlobalProtect, the VPN gateway of Palo Alto Networks firewalls. The vendor disclosed it on May 13, 2026 and rates it as attacked (“Attacked”).

A flaw that depends on configuration

According to Palo Alto Networks' advisory, only GlobalProtect portals and gateways that accept authentication override cookies (authentication override cookies) are exposed, and only with a particular certificate configuration. Running GlobalProtect is therefore not enough to be vulnerable. Cloud NGFW is not affected. The CVSS 4.0 score is 7.8, but the vendor recommends the highest remediation urgency.

Exploitation has been going on for months. According to Rapid7, cited by The CyberSec Guru, the first attempts date from May 17, four days after the advisory. Arctic Wolf had already linked several June intrusions to Qilin on July 20. What is new is that ReliaQuest also names Settra, a group that emerged in June, and expects exploitation to remain high over the next three months.

What the attackers do

A VPN session opened this way looks like ordinary remote work. In related intrusions, ReliaQuest observed the tools Cobalt Strike, BloodHound and SharpHound. They are used for remote control and for mapping Active Directory. The firm recommends reviewing unexpected GlobalProtect connections, especially those coming from a machine whose name contains “kali.” This is a lead for investigation, not proof.

What to do

• Update PAN-OS to a patched version. According to the vendor's advisory: 12.1.4-h6 or 12.1.7; 11.2.4-h17, 11.2.7-h14, 11.2.10-h7 or 11.2.12; 11.1.4-h33, 11.1.6-h32, 11.1.7-h6, 11.1.10-h25, 11.1.13-h5 or 11.1.15; 10.2.7-h34, 10.2.10-h36, 10.2.13-h21, 10.2.16-h7 or 10.2.18-h6. Versions that are no longer maintained must move to a patched branch.
• Failing that, disable authentication override cookies on the portal and the gateway. If you need them, generate a dedicated certificate to encrypt them, used for nothing else.
• Close all active GlobalProtect sessions after the update. Access obtained before the patch may remain open.
• Review VPN logs going back to mid-May, first for privileged accounts and connections from unusual locations. If in doubt, rotate privileged credentials and launch an investigation.