CVE-2026-0257: Palo Alto Networks PAN-OS Authentication Bypass Vulnerability

Actively exploited: added to CISA’s KEV catalog on May 29, 2026.
Used by ransomware, according to CISA.
Remediation deadline for US federal agencies: June 1, 2026.

Description from CISA’s KEV catalog.

Our analyses

Qilin and Settra ransomware exploit Palo Alto GlobalProtect flaw CVE-2026-0257

The GlobalProtect vulnerability patched in May is still an entry point for ransomware. On October 11, ReliaQuest named the Qilin and Settra groups. Updating is not enough: organizations must also hunt for suspicious VPN access.

Oct 12, 20262 min read

Cybersecurity

Qilin ransomware suspect arrested in Japan and handed over to Germany

A 28-year-old Russian suspected of being a leader of the Qilin ransomware group was arrested in Japan and transferred to Germany, authorities in North Rhine-Westphalia announced on October 7.

Oct 12, 20262 min read

What to do

Check whether your estate includes Palo Alto Networks PAN-OS, including internet-facing devices.
Apply the vendor’s patch or mitigations (references below). Failing that, isolate the product or stop using it, as CISA requires of US federal agencies.
An exploited vulnerability has often been used before it was fixed: look for signs of compromise, especially on internet-facing devices.

References

Vendor advisory or reference cited by CISA (security.paloaltonetworks.com)
NVD entry (NIST)
CISA KEV catalog

Other Palo Alto Networks vulnerabilities

All exploited Palo Alto Networks vulnerabilities