Ransomware Groups Qilin and Settra Exploit Months-Old Palo Alto VPN Flaw
Despite patches released in May, ransomware groups Qilin and Settra are actively exploiting a critical Palo Alto Networks VPN vulnerability, CVE-2026-0257, to gain initial network access.
Ransomware operations Qilin and Settra are actively exploiting a critical authentication bypass vulnerability in Palo Alto Networks' GlobalProtect and Prisma Access products, months after patches were made available. The vulnerability, tracked as CVE-2026-0257, allows threat actors to establish unauthorized VPN sessions, serving as an initial access vector into victim networks.
ReliaQuest, a cyber threat detection provider, highlighted in an advisory that these groups are deploying offensive security tools like Cobalt Strike, BloodHound, and SharpHound following their exploitation of the flaw. The vulnerability was initially disclosed by Palo Alto Networks on May 13, 2026, with a CVSS score of 7.8, later escalated to a critical 9.1 by the NVD. Palo Alto Networks urged customers to deploy fixed versions, noting limited exploit attempts on unpatched devices even at the time of disclosure.
The US Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-0257 to its Known Exploited Vulnerabilities (KEV) catalog on May 29, mandating remediation for US federal agencies by June 1. Despite these warnings and the addition to the KEV list, a significant number of systems remain vulnerable. Threat intelligence firms, including Rapid7, Palo Alto's Unit 42, and Arctic Wolf, have reported ongoing exploitation attempts throughout the summer.
The continued exploitation is particularly concerning because access gained through a compromised VPN can easily be mistaken for legitimate remote work traffic. This can allow attackers to operate undetected for extended periods, potentially leading to credential theft, lateral movement, data exfiltration, and ultimately, ransomware deployment. ReliaQuest assesses that exploitation attempts are highly likely to persist over the next three months.
The affected products include PAN-OS versions 10.2.0, 11.1.0, 11.2.0, and 12.1.0, as well as Prisma Access versions 10.2.0 and 11.2.0. Organizations still running vulnerable Palo Alto Networks VPNs are strongly advised to immediately upgrade their affected deployments. Additionally, it is recommended to disable authentication override cookies if they are not essential for operations.
Beyond patching, organizations should terminate all active GlobalProtect sessions post-remediation and meticulously investigate any unexpected connections, particularly those using hostnames like 'kali,' which are often associated with penetration testing or malicious activity. ReliaQuest cautions that patching alone may not be sufficient to remove access that was already established before the mitigation was applied.
This ongoing exploitation underscores a persistent challenge in cybersecurity: the gap between vulnerability disclosure and widespread patching. Ransomware groups are adept at identifying and weaponizing unpatched vulnerabilities, especially those that offer a stealthy entry point like VPNs. The continued targeting of CVE-2026-0257 serves as a stark reminder for organizations to prioritize timely patching and implement robust network monitoring to detect and respond to unauthorized access attempts.