Topic
Security flaws in VPN and remote-access gateways, which attackers use to gain initial access to corporate networks.
Qilin and Settra ransomware groups are exploiting CVE-2026-0257, a PAN-OS GlobalProtect and Prisma Access authentication bypass disclosed in May. ReliaQuest says access through a victim's own VPN can look like remote work until credential theft or ransomware deployment is underway.
Reality
Volexity says UTA0576 used a zero-day chain to get unauthenticated root on a fully patched Ivanti Connect Secure 22.8R2.4 VPN. Ivanti's Integrity Checker Tool does not flag it, so the check for lateral movement from the VPN device falls to forensics.
Perspective Coverage
10 publishersReality
ReliaQuest reports ransomware actors are exploiting CVE-2026-0257, an authentication bypass in Palo Alto PAN-OS GlobalProtect and Prisma Access. The Bedrock Agents credential flaw Zenity found is already fixed.
Reality
Palo Alto Networks rates the 7.8-score CVE-2026-0257 GlobalProtect bypass at highest urgency after limited exploit attempts. Exposure needs authentication override cookies plus a specific certificate setup, and the fix costs users one re-login.
Reality
ReliaQuest says Qilin and Settra ransomware groups are exploiting CVE-2026-0257, a PAN-OS GlobalProtect auth bypass disclosed May 13. Upgrading closes the entry point, but sessions opened before the upgrade may survive it.
Reality