Key points
- Ransomware groups exploit CVE-2026-0257 to bypass authentication in GlobalProtect.
- Attackers use trusted remote access services to enter internal networks silently.
- ReliaQuest identifies Qilin and Settra as active threat groups using this flaw.
Security teams must immediately inspect their Palo Alto Networks remote access logs for signs of unauthorized entry. According to Cyber Security News, ransomware actors are actively exploiting CVE-2026-0257, an authentication bypass vulnerability affecting PAN-OS GlobalProtect and Prisma Access. This flaw allows attackers to create VPN sessions without valid credentials.
The danger lies in the stealthy nature of these intrusions. Instead of brute-forcing external firewalls, attackers hijack trusted remote access services. This method makes detection significantly harder for security operations centers that rely on standard perimeter alerts. Organizations relying on these products for employee connectivity face immediate risk.
View the original post on X
What we know
ReliaQuest reported that multiple threat groups have begun weaponizing this specific vulnerability for malicious access. The intelligence firm identified Qilin and Settra as two distinct ransomware groups currently leveraging the flaw. These actors use the bypass to establish unauthorized VPN sessions directly into corporate internal networks.
The exploitation targets the authentication mechanisms within Palo Alto Networks' PAN-OS GlobalProtect and Prisma Access platforms. By circumventing identity verification, attackers gain the same access rights as legitimate remote users. This effectively nullifies the security boundary intended by the virtual private network infrastructure.
The activity presents a serious detection challenge for defenders, according to the Cyber Security News report. Because the connection appears to originate from a trusted service, traditional intrusion detection systems may not flag the traffic. This stealthy approach allows threat actors to move laterally before security teams realize a breach has occurred.
Defender's checklist
- Review GlobalProtect and Prisma Access logs for unusual session creations or login patterns.
- Check for VPN connections originating from unexpected geographic locations or user agents.
- Verify that all remote access sessions have valid, multi-factor authenticated credentials.
- Isolate any endpoints that connected via VPN during the suspected exploitation window.
Background: Intrusion detection systems
Intrusion detection systems monitor network traffic for suspicious patterns. They alert you to potential breaches but do not block them. Deploy them when you have resources to investigate alerts and combine them with prevention controls for effective defense.
Read the full guide: Intrusion Detection Systems: Benefits, Limits, and When to Deploy
What to do and how to stay safe: Palo Alto Networks
- Audit current GlobalProtect and Prisma Access configurations for anomalous authentication events.
- Monitor network traffic for new VPN tunnels established without prior user registration.
- Enforce strict multi-factor authentication policies for all remote access connections immediately.
- Wait for official vendor guidance before attempting manual configuration changes to fix the bypass.
Step-by-step guide: Security Advisories: Small Business Patching Strategy
General security guidance from the Malware Chronicle newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-0257?
It is an authentication bypass vulnerability affecting Palo Alto Networks PAN-OS GlobalProtect and Prisma Access that allows unauthorized VPN access.
Which ransomware groups are using this flaw?
ReliaQuest reports that Qilin and Settra are actively exploiting this vulnerability to enter internal networks via trusted remote access services.
Why is this attack hard to detect?
Attackers use trusted remote access services to create sessions, making the traffic appear legitimate and bypassing standard perimeter alerts.
