"Because this access originates through an organization’s own VPN, malicious activity can resemble legitimate remote work and may go undetected until credential theft, lateral movement, data theft or ransomware deployment is underway," ReliaQuest warned on October 9.
CVE-2026-0257 and the affected Palo Alto products
CVE-2026-0257 is an authentication bypass vulnerability in PAN-OS GlobalProtect and Prisma Access disclosed by Palo Alto Networks on May 13, 2026. Palo Alto assigned the flaw a 7.8 CVSS severity score and a “highest” urgency rating; the vulnerability enrichment team at the US National Vulnerability Database (NVD), part of the US National Institute of Standards and Technology (NIST), assigned a critical severity rating of 9.1.
The vulnerability affects several PAN-OS versions — 10.2.0, 11.1.0, 11.2.0 and 12.1.0 — and two versions of Prisma Access, 10.2.0 and 11.2.0. Palo Alto released fixed versions and urged customers to deploy them, saying it had “become aware of limited exploit attempts on unpatched PAN-OS devices without mitigations applied.” The flaw was added to the US Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities (KEV) list on May 29, with US federal agencies urged to apply remediation by June 1.
Observed exploitation: Qilin and Settra, plus offensive tooling
ReliaQuest confirmed on October 9 that ransomware groups Qilin and Settra are actively exploiting CVE-2026-0257 to establish unauthorized VPN sessions and gain initial access to internal networks. Those intrusions have been accompanied by deployment of offensive security tools including Cobalt Strike, BloodHound and SharpHound, according to the advisory.
The vendor-neutral detail in ReliaQuest’s advisory underscores a central risk: access that originates through a legitimate VPN session can blend into normal remote-work traffic, making early detection harder and increasing the likelihood of downstream actions such as credential theft, lateral movement, data exfiltration or ransomware deployment.
The cyber insurance questionnaire just landed. Now what?
SOC 2, HIPAA, insurance renewals - someone has to own security strategy. Nubivance provides fractional CISO leadership without the full-time salary.
Get a security leadThreat intelligence timeline: Rapid7, Unit 42, Artic Wolf, and ReliaQuest
Despite the May 13 disclosure and the release of fixed software, multiple intelligence teams reported attempted exploitation in the months that followed. Rapid7 observed activity in late May; Palo Alto’s Unit 42 reported exploitation in June; and Artic Wolf reported activity in July. ReliaQuest’s advisory on October 9 confirmed ongoing targeting by criminal ransomware groups.
Those repeated sightings indicate that, even after vendor patches and public warnings, some vulnerable systems remained reachable and attractive to adversaries across spring and summer 2026.
ReliaQuest and Palo Alto recommended mitigations
ReliaQuest urged organizations still running vulnerable Palo Alto products to “immediately upgrade affected deployments,” and to apply several operational mitigations: disable authentication override cookies where they are not required; terminate all active GlobalProtect sessions after patching; and investigate unexpected connections, including sessions using hostnames such as ‘kali.’
ReliaQuest also cautioned that “patching alone may not remove access established before remediation,” highlighting that lift-and-clean operations — session termination, credential resets and forensic investigation — are necessary in addition to software updates.
What this means for federal agencies, enterprise security teams, and Palo Alto customers
- Federal agencies: The vulnerability’s addition to CISA’s KEV list on May 29 and the remediation deadline of June 1 meant agencies were formally urged to remediate promptly. The continued exploitation reported through October suggests some agency and contractor systems may still need verification that patches and session-removal steps were completed.
- Enterprise security teams: Security operations and incident response teams should treat VPN-originating sessions as high-risk when tied to CVE-2026-0257 — checking for unexpected hostnames, terminating pre-patch sessions, and looking for follow-on tooling such as Cobalt Strike and BloodHound that the advisory observed.
- Palo Alto customers and procurement leaders: Organizations using PAN-OS and Prisma Access versions named in the advisory must ensure they have installed the vendor’s fixed versions and applied the operational mitigations ReliaQuest recommended; they should also account for the advisory’s warning that remediation may require more than a patch roll-out.
Five months after the initial disclosure, the record in the public advisories is stark: a high-severity authentication bypass in widely used VPN software has been patched, but exploitation persisted into the summer and was explicitly observed in October by a third-party detection provider. The practical takeaway is pointed and concrete — software updates must be paired with session termination, credential hygiene and active investigation of anomalous VPN connections if organizations are to close the window attackers continue to exploit.
Original reporting: https://www.infosecurity-magazine.com/news/palo-alto-vpn-vulnerability-target/
