On October 9, threat detection firm ReliaQuest warned that two ransomware gangs, Qilin and Settra, are using CVE-2026-0257 in live attacks, Infosecurity Magazine reported. Palo Alto Networks disclosed the flaw on May 13, 2026, rated it 7.8, and released fixes. The affected PAN-OS builds are 12.1.0, 11.2.0, 11.1.0 and 10.2.0. Cloud NGFW is affected in all instances, plus Prisma Access 11.2.0 and 10.2.0.
A VPN lets staff reach company systems from outside the office. This flaw is an authentication bypass in GlobalProtect and Prisma Access. ReliaQuest said groups use it to open unauthorised VPN sessions. It said the access can look like normal remote work and may go unnoticed. It also said patching alone may not remove access gained before the fix. It advised ending all active GlobalProtect sessions after patching and disabling authentication override cookies where not needed. The sources do not say why sessions outlast a patch, or how many organisations are still exposed.
"We patched" does not answer "were attackers already in". Executives can ask the security team when the fix was applied and when sessions were ended. They can also ask whether VPN logs were checked for odd hostnames, such as "kali". ReliaQuest rated it highly likely that attempts will go on for the next three months.