Ransomware operators don't always need a zero-day — sometimes a five-month-old patch nobody applied is enough. That is exactly what is happening with CVE-2026-0257, a Palo Alto GlobalProtect VPN authentication bypass that Qilin and Settra are now using to walk into corporate networks through a trusted remote-access door.
What is CVE-2026-0257, the Palo Alto GlobalProtect vulnerability?
CVE-2026-0257 is an authentication bypass in the GlobalProtect portal and gateway in Palo Alto Networks PAN-OS, and in certain Prisma Access configurations. Per Palo Alto's advisory it is rated CVSS 7.8 (High) with the vendor's highest urgency, and it lets an attacker without valid credentials bypass security restrictions and establish an unauthorized VPN connection. Palo Alto published the fix on 2026-05-13 (last updated 2026-06-03) and noted limited exploit attempts against unpatched devices at the time.
The important detail for defenders: a successful exploit produces what looks like a legitimate remote-access session. The attacker is not dropping an obvious web shell — they are logging in the way an employee would.
Who is affected by this Palo Alto GlobalProtect vulnerability?
The affected products are PAN-OS deployments running GlobalProtect portals or gateways, plus specific Prisma Access releases. The advisory lists fixed builds across these trains:
| Product | Affected trains | Action |
|---|---|---|
| PAN-OS | 12.1, 11.2, 11.1, 10.2 | Upgrade to the fixed build for your train (see Palo Alto advisory) |
| Prisma Access | 11.2.0, 10.2.0 | Upgrade to the fixed hotfix release |
If you run GlobalProtect VPN for remote access and have not applied the May 2026 fix for your train, treat this as an exposed, actively targeted system.
Ransomware groups are exploiting CVE-2026-0257
The reason this old flaw is back in the headlines is active ransomware use. Threat-detection firm ReliaQuest reports that the Qilin and Settra ransomware groups are exploiting CVE-2026-0257 to create unauthorized VPN sessions and enter internal networks through trusted remote-access services. Because the malicious traffic resembles normal remote work, it can blend into day-to-day activity and evade quick detection.
ReliaQuest observed the intrusions accompanied by common post-compromise tooling — Cobalt Strike, BloodHound and SharpHound — used to map the environment and escalate. The firm assessed it "highly likely" that these groups will keep exploiting the flaw over the next three months. Rapid7 has independently reported observing exploitation of the same GlobalProtect authentication bypass. The vulnerability has been patchable for roughly 149 days, which makes this a patch-adoption story as much as a vulnerability story.
Why patching alone doesn't close the risk
Applying the fix stops new bypasses, but it does not undo access an attacker already established, and it does nothing for the window every organization leaves open between disclosure and deployment. When the intrusion arrives as a valid-looking VPN session, three gaps decide the outcome:
- Single-vendor dependency. If your remote-access perimeter is one vendor's appliance, every unpatched day is total exposure with no fallback.
- Flat trust after login. A VPN that grants broad network reach once a session is up turns one bypass into lateral movement.
- Credential and session hygiene. Sessions that look legitimate survive until credentials are rotated and access is re-scoped.
The vendor-diverse, least-privilege response
This is the recurring pattern across 2026's appliance incidents — NetScaler, SonicWall SMA 1000, F5 BIG-IP, FortiGate — and the practical response is the same.
- Keep an independent, vendor-diverse standby. OpenVPN Access Server gives you a remote-access layer that does not share a codebase or patch cycle with your primary appliance, so a single-vendor CVE isn't a single point of failure.
- Segment with ZTNA instead of flat VPN trust. CloudConnexa delivers zero trust network access (ZTNA) so a compromised session reaches only explicitly allowed resources — not the whole internal network. Least-privilege access is the control that limits the blast radius when a bypass looks like a normal login.
This is not a reason to rip out GlobalProtect; it is a reason not to let any one appliance be the only thing standing between attackers and your network. Patch CVE-2026-0257 now, rotate credentials on exposed gateways, and make sure a second, independent path exists. (Weighing your options? See how OpenVPN compares with Palo Alto Networks.)
Frequently asked questions
What is CVE-2026-0257?
It is an authentication bypass vulnerability (CVSS 7.8, High) in the Palo Alto Networks PAN-OS GlobalProtect portal and gateway, and certain Prisma Access configurations, that lets an attacker establish an unauthorized VPN connection without valid credentials. Palo Alto patched it on 2026-05-13.
Is CVE-2026-0257 being actively exploited?
Yes. ReliaQuest reports the Qilin and Settra ransomware groups are using it to open unauthorized VPN sessions and enter internal networks, with Rapid7 independently reporting observed exploitation. Palo Alto's advisory also noted limited exploit attempts against unpatched devices.
How do I fix the Palo Alto GlobalProtect vulnerability?
Upgrade PAN-OS and Prisma Access to the fixed build for your release train as listed in Palo Alto's advisory, then rotate credentials and review logs on any gateway that was exposed, since patching does not evict access an attacker already gained.
Why does ransomware target GlobalProtect VPN?
A VPN authentication bypass gives attackers a trusted-looking way into a network. Sessions created this way resemble normal remote work, so they can evade detection while the attacker deploys tooling and moves laterally.
How does OpenVPN reduce this risk?
Access Server provides an independent, vendor-diverse remote-access standby so a single appliance CVE is not a single point of failure, and CloudConnexa adds zero trust network access that limits a compromised session to only explicitly permitted resources.
