Qilin and Settra Ransomware Groups Exploit Palo Alto VPN Flaw

ReliaQuest confirms ransomware operators are actively abusing a high-severity authentication bypass in Palo Alto Networks products to gain initial access.

Threat Times Intrusion DeskOctober 12, 20262 min read

Share LinkedIn Reddit

Illustration: A sleek, black network appliance sits on a clean white surface. — AI-generated illustration: Threat Times

Key points

Qilin and Settra ransomware groups are actively exploiting CVE-2026-0257 to establish unauthorized VPN sessions.
The vulnerability affects PAN-OS GlobalProtect and Prisma Access, with patches released in May 2026.
ReliaQuest warns that malicious activity via legitimate VPN channels may remain undetected until lateral movement occurs.

ReliaQuest confirmed on October 9 that the Qilin and Settra ransomware operations are actively exploiting a high-severity vulnerability in Palo Alto Networks products to gain initial access to internal networks. The threat detection provider warned that these groups are using the flaw to establish unauthorized Virtual Private Network sessions.

CVE-2026-0257 is an authentication bypass vulnerability within PAN-OS GlobalProtect and Prisma Access. Palo Alto Networks disclosed the issue on May 13, 2026, assigning it a CVSS score of 7.8 and a “highest” urgency rating. Despite the vendor releasing fixed versions months ago, multiple threat intelligence teams, including Rapid7, Palo Alto’s Unit 42, and Artic Wolf, have reported attempted exploitation of the flaw since late May.

Context and Background

The vulnerability affects several specific software versions, including PAN-OS 10.2.0, 11.1.0, 11.2.0, and 12.1.0. It also impacts all instances of Palo Alto’s Cloud New Generation Firewall and two versions of Prisma Access: 10.2.0 and 11.2.0. Palo Alto Networks discovered the flaw itself and urged customers to deploy mitigations after becoming aware of limited exploit attempts on unpatched devices without applied safeguards.

ReliaQuest assessed that it is highly likely these ransomware groups will continue their exploitation attempts over the next three months. The provider noted that observed attacks often involve the deployment of offensive security tools such as Cobalt Strike, BloodHound, and SharpHound. These tools facilitate further compromise after the initial breach.

Who Is Affected

Organizations running vulnerable Palo Alto products remain at risk if they have not applied the necessary patches. ReliaQuest highlighted that because the access originates through an organization’s own VPN infrastructure, the malicious activity can resemble legitimate remote work. This mimicry may allow attackers to operate undetected until credential theft, lateral movement, data exfiltration, or ransomware deployment is already underway.

The threat detection provider advised that organizations should investigate unexpected connections, including sessions using hostnames such as “kali.” ReliaQuest listed this as a specific indicator for investigation in its advisory.

What should you do?

ReliaQuest urged organizations still running vulnerable Palo Alto products to immediately upgrade affected deployments. The provider also recommended disabling authentication override cookies where they are not required for business operations. Additionally, administrators should terminate all active GlobalProtect sessions after patching to ensure no unauthorized persistence remains in the system.

What to do and how to stay safe: Palo Alto Networks

Verify if your environment runs PAN-OS versions 10.2.0, 11.1.0, 11.2.0, or 12.1.0, or Prisma Access versions 10.2.0 and 11.2.0.
Check for unauthorized VPN sessions or connections using suspicious hostnames like “kali” in your logs.
Terminate all active GlobalProtect sessions immediately after applying the vendor’s security patches.

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.