# Ransomware Groups Exploit Long-Standing Palo Alto VPN Vulnerability

*Published October 14, 2026*
*Source: [https://www.infosecurity-magazine.com/news/palo-alto-vpn-vulnerability-target/](https://www.infosecurity-magazine.com/news/palo-alto-vpn-vulnerability-target/)*

## Executive Summary

Ransomware groups Qilin and Settra are actively exploiting a vulnerability in Palo Alto Networks products, despite the availability of a patch since May 2026. The vulnerability allows unauthorized VPN access, posing a significant risk to organizations that have not yet applied the necessary updates.

## Article

Ransomware groups continue to exploit a significant vulnerability in Palo Alto Networks products, despite the availability of a security patch for several months. ReliaQuest, a cyber threat detection firm, has identified that the Qilin and Settra ransomware operations are actively targeting the CVE-2026-0257 vulnerability. This flaw allows unauthorized VPN sessions, granting attackers initial access to internal networks. The vulnerability affects PAN-OS GlobalProtect and Prisma Access, impacting multiple versions of Palo Alto Networks products.

Discovered in May 2026 by Palo Alto Networks, the vulnerability was initially given a severity score of 7.8 by the company, while the US National Vulnerability Database rated it at a critical severity of 9.1. Despite the release of fixed versions and warnings from cybersecurity agencies, such as CISA, urging prompt remediation, many systems remain vulnerable. Reports from threat intelligence teams like Rapid7, Palo Alto’s Unit 42, and Arctic Wolf have indicated ongoing exploitation attempts.

ReliaQuest has confirmed that the Qilin and Settra groups are using this vulnerability to deploy offensive security tools, including Cobalt Strike, BloodHound, and SharpHound. The nature of the attack, originating through an organization's own VPN, allows malicious activity to mimic legitimate remote work, making it difficult to detect until significant damage, such as credential theft or ransomware deployment, occurs.

Organizations with vulnerable Palo Alto products are advised to immediately upgrade their systems, disable certain authentication features, and thoroughly investigate any unexpected VPN connections. ReliaQuest warns that patching alone may not eliminate access already established by attackers prior to remediation.