# Qilin and Settra exploit authentication bypass in Palo Alto access systems

_Published Thursday, October 15, 2026 at 3:07 PM EDT · Security · Latest · Tier 2 — Notable_

![Qilin and Settra exploit authentication bypass in Palo Alto access systems — Primary](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg8jHVMYXIjddaTrqHbBuPm3mQ6G_g8qlALwitmiIRM9OplZpPxLPDFet7ySOV0OVxPj6cW1oz0K6rydDvGYQGalR1jSt10bz8kti4dWnM0d3NnUBjuymD77_cReujy6AXmFgJgQQvl2qeICur3VHf5vYyOrxz8OFM-bEunzmK9PGDzCzzTVFVEdQyswYho/s1700-nu-rw-lo-l85-e365/threatsday-oct.jpg)

Qilin and Settra ransomware groups are actively exploiting an authentication bypass in PAN-OS GlobalProtect and Prisma Access, The Hacker News reports, citing ReliaQuest. The vulnerability, CVE-2026-0257, was disclosed in May 2026.

ReliaQuest says access through an organization's own VPN can make malicious activity resemble legitimate remote work, concealing credential theft, lateral movement and ransomware deployment. It recommends upgrading affected systems, disabling unnecessary authentication override cookies and terminating active GlobalProtect sessions after patching. Patching alone may leave access established before remediation intact.

## Sources

- [The Hacker News](https://thehackernews.com/2026/10/threatsday-adobe-rce-dns-wallet-theft.html)

---
Canonical: https://techandbusiness.org/newswire/2V9B4EmPnYJO1RJt_7crQg
Published: 2026-10-15T19:07:00.579Z
Story chronology: 2026-10-15T18:49:33.000Z
Retrieved: 2026-10-15T22:13:11.201Z
Publisher: Tech & Business (techandbusiness.org)