Executive Summary
Ransomware groups Qilin and Settra have been identified exploiting CVE-2026-0257, a high-severity authentication bypass vulnerability in Palo Alto Networks PAN-OS GlobalProtect and Prisma Access. By leveraging improperly validated authentication override cookies, attackers can establish unauthorized VPN sessions, allowing them to blend in with legitimate remote work traffic. This stealthy initial access serves as a launchpad for credential theft, lateral movement, and subsequent ransomware deployment.
The attack chain involves gaining initial access through the vulnerable VPN gateway followed by the deployment of tools such as Cobalt Strike, BloodHound, and SharpHound to map active directory environments. This activity highlights a critical risk where traditional perimeter security is bypassed, requiring defenders to focus on post-authentication behavior and rigorous session management.
Organizations using affected versions of PAN-OS (12.1, 11.2, 11.1, and 10.2) or Prisma Access must prioritize patching and certificate rotation. The vulnerability is actively exploited by multiple ransomware operations, and high levels of activity are expected to persist as initial access brokers target unpatched infrastructure.