Five months after Palo Alto Networks issued a fix for a severe authentication bypass flaw in its VPN and remote access products, criminal groups are still breaking in through the same door. ReliaQuest, a cyber threat detection firm, warned on October 9 that ransomware operators including Qilin and Settra are actively exploiting CVE-2026-0257 to hijack VPN sessions and slip into corporate networks undetected.
The vulnerability sits in PAN-OS GlobalProtect and Prisma Access, software many organizations rely on to let employees connect remotely to internal systems. Because the flaw allows attackers to bypass authentication entirely, intruders can establish what looks like a legitimate VPN session without needing stolen credentials in the traditional sense. That makes detection unusually difficult, since the resulting traffic can resemble ordinary remote work rather than an intrusion. For IT teams troubleshooting connection problems in the aftermath of patching, it can help to understand what to try when a VPN will not connect, since remediation steps like terminating active sessions can disrupt legitimate users along with any lingering unauthorized ones.
A Patch That Hasn't Closed the Door
Palo Alto Networks disclosed CVE-2026-0257 on May 13, 2026, assigning it a CVSS score of 7.8 and its highest internal urgency rating. The US National Vulnerability Database took an even grimmer view, rating the flaw 9.1, in the critical range. The discrepancy reflects how differently vendors and independent scoring bodies sometimes weigh exploitability and potential impact, but both assessments pointed to the same conclusion: this was a flaw worth fixing immediately.
Fixed versions were released promptly, and the US Cybersecurity and Infrastructure Security Agency added the vulnerability to its Known Exploited Vulnerabilities list on May 29, giving federal agencies a June 1 deadline to remediate. Yet threat intelligence teams at Rapid7, Palo Alto's own Unit 42, and Arctic Wolf each separately documented continued exploitation attempts through May, June, and July. The pattern is familiar in enterprise security: patches exist, but deployment lags, particularly in large or complex environments where VPN gateways sit at the center of daily operations and cannot easily be taken offline.
Why VPN Gateways Remain a Prime Target
VPN appliances are attractive to ransomware groups precisely because they are designed to be trusted entry points. A successful compromise grants a foothold inside the network perimeter, bypassing many of the defenses built to stop external attackers. ReliaQuest observed the Qilin and Settra groups pairing this access with established offensive tools, including Cobalt Strike for command and control, and BloodHound and SharpHound for mapping internal network relationships, a hallmark of the reconnaissance phase that precedes lateral movement and eventual ransomware deployment.
What Organizations Should Do Now
ReliaQuest assessed it as highly likely that exploitation attempts will continue over the coming months, and its guidance for defenders goes beyond simply applying the patch.
- Upgrade all affected PAN-OS and Prisma Access deployments to fixed versions immediately.
- Disable authentication override cookies where they are not strictly required.
- Terminate all active GlobalProtect sessions after patching, since existing sessions may have been established before remediation.
- Investigate unexpected or suspicious connections, including those using generic hostnames such as "kali," often associated with penetration testing tools repurposed by attackers.
The core warning is straightforward but easy to overlook: patching closes the vulnerability going forward, but it does not retroactively revoke access already obtained through it. For organizations still running unpatched systems, the exposure window may already have produced consequences that only surface once credential theft, data exfiltration, or ransomware activity is well underway.
