Palo Alto GlobalProtect Auth Bypass CVE-2026-0257 Enables Stealthy Qilin Settra VPN Access
Ransomware groups Qilin and Settra are actively using an authentication bypass in Palo Alto Networks GlobalProtect to create stealthy, unauthorized VPN sessions.
Key points
- CVE-2026-0257 allows attackers to bypass authentication and establish unauthorized VPN connections without valid credentials.
- Threat groups Qilin and Settra are actively exploiting the flaw to infiltrate networks through trusted remote access services.
- Palo Alto Networks rates the vulnerability as High severity with a CVSS score of 7.8 and urges immediate response.
Ransomware operators are actively exploiting CVE-2026-0257, an authentication bypass vulnerability in Palo Alto Networks PAN-OS GlobalProtect and Prisma Access. According to ReliaQuest, threat groups including Qilin and Settra use this flaw to create unauthorized VPN sessions. This allows attackers to enter internal networks via trusted remote access services rather than through suspicious external connections.
Root cause
The vulnerability stems from how GlobalProtect portals and gateways handle authentication override cookies. Palo Alto Networks disclosed the issue on May 13, 2026, assigning it a CVSS score of 7.8 and a High severity rating. The flaw permits attackers to bypass security restrictions and establish connections without completing the standard authentication process. This occurs when specific configuration settings are present, particularly when authentication override cookies are enabled alongside a certain certificate setup.
View the original post on X
Attack path
Attackers leverage the vulnerability to connect through an organization’s own VPN infrastructure. According to ReliaQuest, this makes their traffic resemble normal remote work, creating a serious detection challenge. Intruders can steal credentials, move laterally between systems, and collect sensitive data before security teams recognize the intrusion. ReliaQuest observed related activity involving Cobalt Strike, BloodHound, and SharpHound. These tools indicate that defenders must investigate post-connection behavior rather than assuming a successful VPN login proves user legitimacy.
Affected versions
Exposure depends on specific configurations; not every deployment is affected. A GlobalProtect portal or gateway must have authentication override cookies enabled with a specific certificate configuration to be vulnerable. Palo Alto Networks lists affected releases across PAN-OS 12.1, 11.2, 11.1, and 10.2. Prisma Access versions 11.2 and 10.2 are also listed as affected. Panorama and Cloud NGFW products are not affected by this vulnerability. Administrators must check their exact maintenance release against the vendor’s fixed version table.
Mitigation
Organizations should immediately upgrade affected deployments to patched versions. ReliaQuest recommends disabling authentication override cookies where they are unnecessary to reduce exposure. Administrators should terminate all active GlobalProtect sessions after patching to ensure no unauthorized connections remain. Investigators should scrutinize unexpected GlobalProtect connections, including sessions linked to hostnames like “kali.” However, such hostnames should be evaluated alongside connection history and other evidence rather than treated as definitive proof of attribution.
What to do and how to stay safe: Palo Alto Networks
- Review your GlobalProtect portal and gateway configurations to determine if authentication override cookies are enabled.
- Check your PAN-OS and Prisma Access maintenance releases against the vendor’s advisory to confirm if you are running an affected version.
- Monitor VPN logs for unexpected connections or sessions that do not match normal remote work patterns, paying attention to unusual hostnames.
- Once the vendor provides an update, apply it immediately and terminate existing sessions to clear any potential unauthorized access.
Step-by-step guide: Attack Surface Management: 6 Common Misreadings and Correct Views
General security guidance from the NetSec Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Is CVE-2026-0257 being exploited in the wild?
Yes, ReliaQuest reports that ransomware groups Qilin and Settra are actively exploiting the flaw to create unauthorized VPN sessions.
Which Palo Alto Networks products are affected by this vulnerability?
PAN-OS GlobalProtect and Prisma Access are affected; Panorama and Cloud NGFW are not affected.
How can attackers hide their activity when exploiting this flaw?
Attackers connect through the organization’s own VPN, making their traffic look like legitimate remote work, which delays detection.
