Ransomware Hackers Exploit Palo Alto Networks GlobalProtect VPN Authentication Bypass Vulnerability

ReliaQuest warns that CVE-2026-0257 — an authentication bypass in Palo Alto Networks GlobalProtect and Prisma Access — is being actively exploited by ransomware groups (including Qilin and Settra) to establish unauthorized VPN sessions, enabling credential theft, lateral movement, data exfiltration, and ransomware deployment; the report lists remediation steps (patching, disabling authentication-override cookies, terminating sessions) and provides IPv4 indicators to support investigations.