Qilin and Settra ransomware crews exploit PAN-OS GlobalProtect bypass CVE-2026-0257
Qilin and Settra ransomware groups are exploiting CVE-2026-0257, a PAN-OS GlobalProtect and Prisma Access authentication bypass disclosed in May. ReliaQuest says access through a victim's own VPN can look like remote work until credential theft or ransomware deployment is underway.
The Watch · Security desk
Qilin and Settra ransomware groups exploit CVE-2026-0257, an authentication bypass in GlobalProtect and Prisma Access. Access via an organization's own VPN can resemble remote work. ReliaQuest says patching alone may not remove earlier access and advises ending active sessions after patching.
- What's now possible capability Qilin and Settra Ransomware groups actively exploiting CVE-2026-0257, claim 1
- Who's exposed exposure GlobalProtect, Prisma Access CVE-2026-0257 is an authentication bypass in PAN-OS GlobalProtect and Prisma Access, claim 2
- What it limits constraint Organizations Access through their own VPN can resemble legitimate remote work and may go undetected, claim 4
- What it limits constraint Organizations that patch Patching alone may not remove access established before remediation, ReliaQuest says, claim 8
- Who has to decide decision ReliaQuest Advises terminating all active GlobalProtect sessions after patching, claim 6
| Who | How | Kind | Claim |
|---|---|---|---|
| Qilin and Settra | Ransomware groups actively exploiting CVE-2026-0257 | capability | 1 |
| GlobalProtect, Prisma Access | CVE-2026-0257 is an authentication bypass in PAN-OS GlobalProtect and Prisma Access | exposure | 2 |
| Organizations | Access through their own VPN can resemble legitimate remote work and may go undetected | constraint | 4 |
| Organizations that patch | Patching alone may not remove access established before remediation, ReliaQuest says | constraint | 8 |
| ReliaQuest | Advises terminating all active GlobalProtect sessions after patching | decision | 6 |
What happened
- ReliaQuest tells operators to upgrade affected deployments immediately and to disable authentication override cookies wherever they are not required.
- After patching, ReliaQuest says, defenders should terminate all active GlobalProtect sessions.
- ReliaQuest also advises investigating unexpected connections, including sessions that use hostnames such as 'kali'.
Why it matters
- Who's exposed exposure Any GlobalProtect or Prisma Access deployment still on an affected build is being targeted by ransomware crews now, so the upgrade is the first deadline.
- What it limits constraint The logon itself looks routine, so detection has to lean on later activity and on session details such as hostnames.
- Who has to decide decision Teams that patched after exploitation began have to choose whether to reset every session and hunt before calling the gateway clean.
The ransomware attribution rests on one weekly roundup at thehackernews.com. It names Qilin and Settra as the groups exploiting the flaw [1]. ReliaQuest is its only named source, and what it is quoted on is defensive guidance. The bulletin does not identify the firm that observed the ransomware activity, and it includes no fixed versions, severity score, victim counts or date for first exploitation.
ReliaQuest gives the reason for resetting sessions in its own words: "Patching alone may not remove access established before remediation." [8] The flaw was disclosed in May and has been exploited since [3]. A gateway patched at any point after the first intrusions could already hold such access.
The hostname check ReliaQuest suggests, looking for sessions that use names such as 'kali', is cheap [7]. We'd expect it to catch careless operators only. A renamed host passes it.
The bulletin did not disclose how the bypass works, whether authentication override cookies are the way in, or whether disabling them closes the path or only narrows it. ReliaQuest lists disabling them as a step, "where they are not required" [5].
Two named ransomware groups on one gateway bug is a different problem from one crew with a private exploit [1]. How either group obtained it is not in the bulletin. We think the method is circulating beyond a single actor.
What to watch
- The vendor advisory or a second research firm confirming fixed versions, a severity score and how the bypass works.
- A named incident-response firm saying it observed Qilin and Settra intrusions, with victim counts and a first-exploitation date.
- Indicators beyond the 'kali' hostname that separate attacker sessions from staff sessions.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence40
- Adoption
- Not scored
- Hype gap−5
- Incentives
- Not scored
- Confidence50
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Qilin and Settra ransomware groups are actively exploiting CVE-2026-0257.
- [2]
CVE-2026-0257 is an authentication bypass vulnerability in PAN-OS GlobalProtect and Prisma Access.
- [3]
The vulnerability was disclosed in May 2026 and has since come under active exploitation.
- [4]
ReliaQuest said: "Because this access originates through an organization's own VPN, malicious activity can resemble legitimate remote work and may go undetected until credential theft, lateral movement, data theft, or ransomware deployment is underway."
- [5]
ReliaQuest advises organizations to immediately upgrade affected deployments and disable authentication override cookies where they are not required.
- [6]
ReliaQuest advises terminating all active GlobalProtect sessions after patching.
- [7]
ReliaQuest advises investigating unexpected connections, including sessions using hostnames such as 'kali'.
- [8]
ReliaQuest said: "Patching alone may not remove access established before remediation."
Get this ledger inside ChatGPT. Ask about any of our stories and the answer brings its figure, each claim’s verdict and the sources. Free, no account.
Sources
1 independent publisher whose own reporting we read for this story.
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.
Entities
- PAN-OS GlobalProtectFollow
- SettraFollow
- The Hacker NewsFollow
- QilinFollow
- CVE-2026-0257Follow
- ReliaQuestFollow