PANW · News · 20261011N

GlobalProtect Vulnerability Exploitation

Palo Alto Networks Inc · 2026-10-11 · Importance 47 · Surprise 60

Ransomware groups Qilin and Settra are reportedly exploiting CVE-2026-0257, an authentication-bypass vulnerability affecting Palo Alto Networks’ PAN-OS GlobalProtect and Prisma Access. The flaw can enable unauthorized VPN sessions that appear to be legitimate remote access, creating cybersecurity and potential regulatory-response risk for affected customers. Recommended mitigations include upgrading affected systems, disabling unnecessary authentication-override cookies, and investigating suspicious VPN connections.

Key facts

• Ransomware groups Qilin and Settra are actively exploiting CVE-2026-0257, an authentication bypass vulnerability in Palo Alto Networks PAN-OS GlobalProtect and Prisma Access. source
• The CVE-2026-0257 flaw allows attackers to create unauthorized VPN sessions, making their network infiltration appear as legitimate remote access. source
• Organizations are urged to immediately upgrade affected systems, disable unnecessary authentication override cookies, and conduct thorough investigations into suspicious VPN connections. source