Ransomware Groups Actively Exploit Palo Alto Networks VPN Auth Bypass

Ransomware operators, including the Qilin and Settra groups, are actively exploiting CVE-2026-0257, an authentication bypass vulnerability in Palo Alto Networks PAN-OS GlobalProtect and Prisma Access. The vulnerability allows attackers to establish unauthorized VPN sessions without completing normal authentication, enabling them to mimic legitimate remote work inside the perimeter. The flaw requires specific configurations to be exploitable, specifically that authentication overrides must be enabled alongside a certain certificate configuration. ReliaQuest reports that attackers are using this unauthorized access to deploy tools like Cobalt Strike, BloodHound, and SharpHound for credential theft and lateral movement. Administrators are advised to upgrade affected deployments, disable unnecessary authentication overrides, and aggressively terminate all active GlobalProtect sessions post-patching to sever any already-established attacker access.