Qilin and Settra exploit patched Palo Alto VPN flaw
Ransomware operators Qilin and Settra are exploiting a five-month-old vulnerability in Palo Alto Networks’ remote-access software to penetrate corporate networks, cybersecurity company ReliaQuest warned on 9 October. The activity targets CVE-2026-0257, an authentication bypass flaw affecting certain configurations of GlobalProtect, the virtual private network service used by organisations to give…
Ransomware groups Qilin and Settra are targeting a five-month-old vulnerability in Palo Alto Networks’ GlobalProtect VPN service, according to cybersecurity firm ReliaQuest. The vulnerability, CVE-2026-0257, allows attackers to bypass authentication and establish unauthorized VPN connections. Palo Alto Networks released fixes for the flaw on 13 May, but attacks have continued against unprotected installations.
ReliaQuest observed ransomware operators using the weakness to gain initial access and deploy their malware, as well as other offensive security tools. The company assessed that exploitation attempts were likely to continue over the next three months. Vulnerable firewalls must have a GlobalProtect portal or gateway configured with authentication override cookies and a specific certificate.
Palo Alto Networks classified the flaw as high severity and recommended customers to upgrade their systems. ReliaQuest urged organizations to terminate active GlobalProtect sessions after patching and investigate unusual connections.
Written by urgent.news from Arabian Post's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
