Key Takeaways

  • Qilin and Settra are exploiting CVE-2026-0257 to establish unauthorized Palo Alto Networks GlobalProtect VPN sessions.
  • Exploitation began within days of the flaw’s May disclosure, and some June intrusions ended in domain-wide ransomware encryption.
  • Patching remains the priority, but security teams should also investigate older VPN activity for signs of credential theft and lateral movement.

Ransomware operators Qilin and Settra are continuing to exploit CVE-2026-0257, an authentication-bypass vulnerability affecting Palo Alto Networks GlobalProtect and Prisma Access, months after a patch became available.

The flaw can allow attackers to create unauthorized VPN sessions, effectively placing them inside a target’s network without completing the expected authentication process. From there, operators can pursue credentials, move laterally, steal information and deploy ransomware.

That sequence makes the vulnerability more consequential than its initial access role might suggest. A compromised VPN session is not ransomware by itself. It is, however, a useful doorway into systems that organizations may have treated as accessible only to trusted employees and contractors.

Palo Alto Networks rated CVE-2026-0257 as high severity with a CVSS score of 7.8. NIST’s National Vulnerability Database assigned it a critical 9.1 rating. The difference reflects how scoring methodologies and assumptions can influence severity, but the exploitation evidence is more important than the label.

CISA and NIST have placed the vulnerability in a broader risk context, with CISA adding CVE-2026-0257 to its Known Exploited Vulnerabilities catalog on May 29, 2026. Inclusion in the catalog indicates confirmed exploitation and gives federal agencies a clear remediation signal. Private-sector organizations often use the same catalog to shape patching priorities.

Attackers moved quickly. Rapid7 observed exploitation beginning May 17, just four days after disclosure. Arctic Wolf Labs later investigated multiple June 2026 intrusions in which exploitation ultimately led to domain-wide Qilin ransomware encryption.

More recent findings show that interest has not disappeared. Rapid7, Arctic Wolf Labs and ReliaQuest have documented activity associated with the flaw, while ReliaQuest reported that Qilin and Settra operators used it to obtain unauthorized VPN access before progressing to credential theft, lateral movement, data theft and ransomware deployment.

A May patch does not eliminate risk in October. Internet-facing infrastructure can remain unpatched because of maintenance constraints, incomplete asset inventories, overlooked appliances or assumptions that another team owns the system. Attackers tend to benefit from those gaps long after the first burst of vulnerability coverage fades.

The potential attack surface is substantial. Shadowserver tracked more than 167,000 internet-exposed GlobalProtect instances, while Shodan identified over 172,000 IP addresses carrying a GlobalProtect fingerprint. Those figures do not show how many systems remained vulnerable, and they should not be read as a count of exploitable devices. They do illustrate how widely deployed the technology is.

Applying Palo Alto Networks’ fixes is the immediate step, but patching alone may not address an intrusion that already occurred. Security teams should review VPN logs dating back to the disclosure period, looking for unusual session creation, unfamiliar source addresses, unexpected geographies and activity outside normal working patterns.

Identity evidence matters too. Organizations can examine password resets, suspicious privilege changes, abnormal administrative logins and signs that credentials were used across multiple systems. Endpoint and network telemetry may reveal remote administration tools, reconnaissance, lateral movement or data staging associated with activity after the initial VPN access.

Incident-response planning should account for the possibility that a seemingly isolated edge-device alert represents the first stage of a larger compromise. If suspicious sessions are found, defenders may need to revoke tokens, rotate exposed credentials and investigate connected endpoints rather than simply closing the VPN connection.

Vulnerability management cannot stop at publishing a patch-compliance percentage. For an actively exploited authentication bypass, organizations also need evidence that remediation reached every exposed instance and that attackers did not arrive first. Months-old access logs may now be the difference between confirming a clean environment and discovering that Qilin or Settra already established a foothold.