Palo Alto Auth Bypass Lets Ransomware Groups Forge VPNs Ignoring May Patch
Ransomware groups are using an unpatched Palo Alto vulnerability to create unauthorized VPN sessions and access internal networks, despite fixes released months ago.
Key points
- ReliaQuest confirms Qilin and Settra ransomware groups are actively exploiting CVE-2026-0257 in Palo Alto Networks products.
- The authentication bypass flaw allows attackers to establish unauthorized VPN sessions, masking malicious activity as legitimate remote work.
- Palo Alto released patches in May 2026, but multiple threat intelligence teams report continued exploitation attempts on unpatched systems.
ReliaQuest confirmed that the Qilin and Settra ransomware operations are actively exploiting a high-severity authentication bypass vulnerability in Palo Alto Networks products. According to the threat detection provider, these groups use CVE-2026-0257 to establish unauthorized VPN sessions, gaining initial access to internal networks despite a security patch being released five months ago.
Root cause
CVE-2026-0257 is an authentication bypass vulnerability affecting PAN-OS GlobalProtect and Prisma Access. Palo Alto Networks discovered the flaw and disclosed it on May 13, 2026, assigning it a CVSS score of 7.8 and a “highest” urgency rating. The vendor stated it had become aware of limited exploit attempts on unpatched devices without mitigations applied at the time of disclosure.
Attack path
Attackers leverage the vulnerability to create unauthorized VPN connections that originate through the organization’s own infrastructure. ReliaQuest noted that this access method allows malicious activity to resemble legitimate remote work, potentially going undetected until credential theft, lateral movement, or ransomware deployment occurs. The groups accompany their exploitation with offensive tools such as Cobalt Strike, BloodHound, and SharpHound.
Affected versions
The vulnerability impacts several Palo Alto Networks products. Affected PAN-OS versions include 10.2.0, 11.1.0, 11.2.0, and 12.1.0. All instances of the Cloud New Generation Firewall (Cloud NGFW) are vulnerable. Additionally, Prisma Access versions 10.2.0 and 11.2.0 are affected by this authentication bypass flaw.
Mitigation
ReliaQuest advised organizations still running vulnerable Palo Alto products to immediately upgrade affected deployments. The provider recommended disabling authentication override cookies where they are not required. Administrators should terminate all active GlobalProtect sessions after patching and investigate unexpected connections, including sessions using hostnames such as ‘kali’.
What to do and how to stay safe: Palo Alto Networks
- Verify that all Palo Alto Networks devices are running patched versions of PAN-OS, GlobalProtect, or Prisma Access.
- Monitor network logs for unexpected VPN connections or sessions using suspicious hostnames like ‘kali’.
- Review active GlobalProtect sessions regularly to identify and terminate any unauthorized or anomalous remote access attempts.
Step-by-step guide: Implement a Ransomware Recovery Plan: Step-by-Step Guide
General security guidance from the NetSec Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which ransomware groups are exploiting CVE-2026-0257?
ReliaQuest confirmed that the Qilin and Settra ransomware groups are actively exploiting this vulnerability to gain initial access to networks.
What is the severity rating of CVE-2026-0257?
Palo Alto Networks assigned the vulnerability a CVSS score of 7.8 and a “highest” urgency rating when it was disclosed in May 2026.
Why is this vulnerability difficult to detect?
Because the access originates through the organization’s own VPN, the malicious activity can resemble legitimate remote work and may go undetected until later stages of the attack.
