Key points
- Ransomware actors are actively exploiting CVE-2026-0257 in Palo Alto Networks PAN-OS GlobalProtect and Prisma Access.
- The flaw allows attackers to bypass authentication and create unauthorized VPN sessions without triggering standard alerts.
- ReliaQuest reports that multiple threat groups, including Qilin and Settra, are using this method to enter internal networks.
Ransomware groups are actively exploiting CVE-2026-0257, an authentication bypass vulnerability affecting Palo Alto Networks PAN-OS GlobalProtect and Prisma Access, according to Cyber Security News. ReliaQuest reports that multiple threat actors are leveraging this flaw to establish unauthorized VPN sessions. These attackers use trusted remote access services as an entry point into internal corporate networks.
By the numbers
- CVE-2026-0257 is the specific identifier for the authentication bypass vulnerability currently being exploited in the wild.
- Multiple distinct ransomware groups, including Qilin and Settra, are actively targeting this specific Palo Alto flaw.
- The exploitation activity presents a serious detection challenge for security teams monitoring standard authentication logs.
What the figures mean
The involvement of established ransomware groups like Qilin and Settra indicates that CVE-2026-0257 has moved from theoretical risk to active exploitation. According to Cyber Security News, these actors are not just scanning for vulnerable systems but are successfully creating unauthorized VPN sessions. This behavior suggests a high level of operational sophistication and a clear intent to maintain persistent access to target environments.
View the original post on X
ReliaQuest notes that the activity presents a serious detection challenge because attackers are entering through trusted remote access services. By bypassing authentication rather than breaking credentials, the attackers avoid generating the typical failed login alerts that security operations teams monitor. This stealthy approach allows threat actors to blend in with legitimate remote worker traffic, making initial compromise difficult to identify through standard log review processes.
What to watch
Security teams should monitor for VPN sessions that originate from unusual geographic locations or times, even if they appear authenticated. Look for discrepancies between user identity and session behavior, such as access to resources outside normal job functions. Pay close attention to any new or modified firewall rules that might facilitate lateral movement after initial entry.
Background: Login alerts
Configure login alerts to trigger only on impossible travel, new devices, or high-risk locations. Suppress notifications for known service accounts and automated scripts. Use step-up authentication for risky logins instead of blocking all unfamiliar access. Review alert thresholds monthly to balance security with user productivity.
Read the full guide: Login Alerts Best Practices: 8 Ways to Stop False Positives
What to do and how to stay safe
- Review GlobalProtect and Prisma Access logs for sessions that bypass standard multi-factor authentication or show anomalous login patterns.
- Isolate any endpoints that exhibit unexpected outbound connections to known command and control infrastructure or unusual DNS queries.
- Verify that all PAN-OS instances are running the latest supported version that addresses CVE-2026-0257, once the vendor provides an update.
- Implement network segmentation to limit the blast radius if an attacker successfully establishes an unauthorized remote access session.
Step-by-step guide: Patch Management Implementation: A Step-by-Step Rollout Plan
General security guidance from the Sandbox Gazette newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which specific ransomware groups are exploiting CVE-2026-0257?
ReliaQuest reports that multiple threat groups, including Qilin and Settra, are actively using this flaw to create unauthorized VPN sessions.
