Months-Old Palo Alto VPN Vulnerability Remains a Target for Ransomware Groups

ReliaQuest and other threat intelligence teams report that ransomware groups including Qilin and Settra are actively exploiting CVE-2026-0257 (an authentication bypass in PAN-OS GlobalProtect/Prisma Access) to create unauthorized VPN sessions and gain initial access; the flaw (CVSS 7.8, NVD 9.1) was patched in May 2026 but remains on CISA's KEV list and unpatched systems continue to be targeted, with observed use of Cobalt Strike and lateral movement tooling and recommendations to patch, terminate sessions, and investigate unexpected connections.