Qilin and Settra exploit authentication bypass in Palo Alto access systems

Qilin and Settra ransomware groups are actively exploiting an authentication bypass in PAN-OS GlobalProtect and Prisma Access, The Hacker News reports, citing ReliaQuest. The vulnerability, CVE-2026-0257, was disclosed in May 2026. ReliaQuest says access through an organization's own VPN can make malicious activity resemble legitimate remote work, concealing credential theft, lateral movement and ransomware deployment. It recommends upgrading affected systems, disabling unnecessary authentication override cookies and terminating active GlobalProtect sessions after patching. Patching alone may leave access established before remediation intact.