Science & Tech · Cybersecurity · 4 hrs ago
Ransomware Groups Exploit Unpatched Palo Alto VPN Vulnerability
Ransomware groups Qilin and Settra are exploiting a security flaw in Palo Alto Networks products to gain access to company networks.
The flaw affects GlobalProtect and Prisma Access, which organizations use for secure remote connections.
Palo Alto Networks disclosed it on May 13, 2026, and released fixes, but some systems still appear to be unpatched.
Attackers can use the flaw to create unauthorized VPN sessions, and their activity may look like legitimate remote work.
ReliaQuest observed the groups using tools that can help them move through networks, and said it is highly likely they will keep trying to exploit the flaw over the next three months.
Organizations using affected products are urged to install the fixes, review suspicious connections and end active GlobalProtect sessions after patching.
Patching may not remove access attackers gained before the fix, so organizations are also advised to investigate their systems.
Qilin and Settra ransomware groups are actively exploiting a Palo Alto Networks VPN vulnerability to gain access to internal networks, ReliaQuest said.
The flaw, CVE-2026-0257, is an authentication bypass affecting PAN-OS GlobalProtect and Prisma Access.
Palo Alto Networks disclosed the vulnerability and released fixes on May 13, 2026, but some systems remain unpatched.
ReliaQuest said the groups have used tools including Cobalt Strike, BloodHound and SharpHound alongside the exploitation.
The provider assessed it as highly likely that exploitation attempts will continue over the next three months.
- Who
- The Qilin and Settra ransomware groups are exploiting the vulnerability, according to ReliaQuest.
- What
- They are using CVE-2026-0257, an authentication bypass, to establish unauthorized VPN sessions and gain initial access to internal networks.
- When
- ReliaQuest issued its warning on October 9, 2026. Palo Alto Networks disclosed the flaw on May 13, 2026.
- Where
- Palo Alto Networks products, including PAN-OS GlobalProtect and Prisma Access.
- Why
- The groups are exploiting the flaw to gain initial access to internal networks.
This story does not have two clearly opposing sides.
Because this access originates through an organization’s own VPN, malicious activity can resemble legitimate remote work and may go undetected until credential theft, lateral movement, data theft or ransomware deployment is underway.
Patching alone may not remove access established before remediation.
Palo Alto Networks disclosed CVE-2026-0257 and released fixed versions.
Rapid7 reported attempted exploitation of the vulnerability.
Palo Alto Networks’ Unit 42 reported attempted exploitation.
Arctic Wolf reported attempted exploitation.
ReliaQuest warned that Qilin and Settra were actively targeting the flaw.
- Vulnerability
- CVE-2026-0257
- Severity score
- 7.8 CVSS
- Disclosure date
- May 13, 2026
- Ransomware groups
- Qilin and Settra
- Exploitation tools
- Cobalt Strike, BloodHound and SharpHound
Sources
Related news
Canadian cybersecurity executive arrested in FBI ShinyHunters investigation
Canadian cybersecurity executive arrested on federal extortion charges
Ricardo users receive phishing messages after data leak
Critical SonicWall flaw faces exploitation days after patch
Bricksforge WordPress Plugin Flaw Exploited in Ongoing Attacks
Cyberattack disables refrigerators at French supermarket stores
GitLab urges users to patch critical code execution flaw
Cyberattack on refrigeration systems affects French supermarket groups
Preinstalled malware found on low-cost Android phones in more than 150 countries
Dark Reading names a new editor-in-chief after 20 years
CyberXero campaign steals more than 628,000 records tied to Ukrainians
