Qilin and Settra Ransomware Crews Exploit Palo Alto GlobalProtect Cookie Flaw CVE-2026-0257

An attacker with no credentials can open a VPN session on a Palo Alto Networks firewall through CVE-2026-0257, provided GlobalProtect has authentication override cookies enabled and a specific certificate configuration. ReliaQuest says the ransomware groups Qilin and Settra are using it, according to Cyber Security News, which reported the update. Palo Alto's advisory, first published May 13, 2026, reports only "limited exploit attempts on unpatched PAN-OS devices without mitigations applied".

The two accounts differ in strength. Palo Alto's own exploitation statement was updated on May 29, 2026 and does not name any actor. The attribution to Qilin and Settra rests on ReliaQuest's threat update, which this site read only through Cyber Security News and did not retrieve directly.

What the flaw allows and what it needs

Palo Alto describes an authentication bypass in the PAN-OS GlobalProtect portal and gateway that lets an attacker get around security restrictions and set up an unauthorized VPN connection. Cyber Security News attributes the root cause to reliance on cookies "without proper validation and integrity checks".

Panorama and Cloud NGFW are not affected. Exposure needs authentication override cookies enabled, plus a specific certificate configuration. The advisory rates the flaw 7.8 (high) and suggests the highest response urgency.

The score understates the position of an exposed device. The 7.8 reflects a base score for a flaw that needs no privileges and no user interaction, but the scope-changed impact is on the network behind the VPN, which is what ransomware crews want. The advisory says the overall severity follows a threat score that rose once exploitation was observed.

Fixed versions

Branch	Fixed in
PAN-OS 12.1	12.1.4-h6, 12.1.7
PAN-OS 11.2	11.2.4-h17, 11.2.7-h14, 11.2.10-h7, 11.2.12
PAN-OS 11.1	11.1.4-h33, 11.1.6-h32, 11.1.7-h6, 11.1.10-h25, 11.1.13-h5, 11.1.15
PAN-OS 10.2	10.2.7-h34, 10.2.10-h36, 10.2.13-h21, 10.2.16-h7, 10.2.18-h6
Prisma Access	11.2.7-h13 (11.2), 10.2.10-h36 (10.2)

Palo Alto says it is upgrading Prisma Access customers on a schedule and that older unsupported PAN-OS versions should move to a supported fixed release.

What ReliaQuest's activity looks like

Cyber Security News reports that the activity involved Cobalt Strike, BloodHound and SharpHound, tools for remote control and for mapping Active Directory. It says attackers can blend in with normal remote work, which gives them time to steal credentials, move laterally and prepare ransomware. ReliaQuest assesses that exploitation is "highly likely to continue over the next three months".

One detection lead from the report is a connecting device whose hostname contains "kali". The report presents it as an investigation lead, not proof of compromise.

What to do

Palo Alto's workarounds are to disable the Authentication Override options for generating and accepting cookies on the portal and gateway, or to use a dedicated certificate only for those cookies instead of the portal or gateway certificate. The relayed ReliaQuest guidance adds terminating all active GlobalProtect sessions after patching, because users will have to re-authenticate and because patching alone may not remove access gained earlier.

Palo Alto points to a Unit 42 Threat Brief for current indicators. For other patch-lag cases the site has covered, see seven CVEs in Red Lion N-Tron firmware and six OpenPDC CVEs with no fix.