Qilin and Settra Are Riding Patched Organizations' Own VPN Sessions Through CVE-2026-0257

ReliaQuest researchers reported on October 9 that Qilin and Settra ransomware affiliates are using CVE-2026-0257, a PAN-OS GlobalProtect authentication bypass, to open VPN sessions that bypass MFA entirely. Brandon Tirado, ReliaQuest's vice president, told Cybersecurity Dive in an October 20 report that the flaw has become a "reliable way into networks" and warned the resulting activity can go undetected because it originates from internal VPNs and resembles legitimate remote work.

That framing matters because the vulnerability is five months old. Palo Alto Networks disclosed CVE-2026-0257 on May 13, rating it CVSS 7.8, and CISA added it to the Known Exploited Vulnerabilities catalog on May 29, giving federal agencies until June 1 to patch or mitigate. ReliaQuest and Infosecurity Magazine, in an October 12 report, both name Settra alongside Qilin as exploiters of the flaw. Unit 42's October 20 update confirms exploitation by Spikey Scorpius, which it maps to Qilin, but only acknowledges separate reports tying Settra to the same CVE — the vendor with direct telemetry into the exploitation has not confirmed the third name carried in this reporting.

How the bypass actually works

The flaw sits in how GlobalProtect handles authentication override cookies. Seceon's October 14 writeup explains that reusing a certificate between the HTTPS service and the authentication override cookie operation exposes the deployment: an attacker who obtains or forges a valid cookie value can present it to the portal or gateway and establish a trusted session without ever supplying credentials. Palo Alto's original advisory specifies the bypass only applies when authentication override cookies are enabled under specific certificate configurations, and that Panorama and Cloud NGFW are not impacted.

The sessions attackers establish generate what Unit 42 calls "gateway-connected" events in PAN-OS logs — the same log entry a legitimate remote employee produces every morning.

What happens after the session opens

Arctic Wolf Labs documented the downstream speed in a July 20 report on intrusions it investigated in June.

eSecurity Planet's forensic review adds the part that should worry infrastructure teams more than the VPN bypass itself. In the intrusions eSecurity Planet examined, attackers who rode a GlobalProtect session into the network reached VMware vCenter and disabled the execInstalledOnly security control on ESXi hosts, a setting meant to restrict which VIBs can run on a hypervisor. With that control off, they extracted domain credentials directly from virtual disks. The same investigations found attackers pairing the VPN access with an unrelated, older flaw — CVE-2023-27532 in Veeam backup infrastructure — specifically to disable recovery before detonating ransomware. Lateral movement inside the environment ran over RDP and SMB.

Aviatrix's technical summary describes the same flow — trusted VPN session, MFA bypass, hypervisor pivot, backup destruction, encryption — but it restates eSecurity Planet's chain rather than adding a second investigation of its own. Cybersecurity Dive's October 20 report lists the toolset observed in these intrusions as Cobalt Strike, BloodHound and SharpHound — commodity red-team tooling running over what the environment logs as an authenticated remote-access session.

Why existing detection rules miss it

Tirado's point to Cybersecurity Dive is the detection problem in one sentence: the activity looks like remote work because, from the network's perspective, it is remote work. A GlobalProtect gateway-connected event carries the same log signature whether the cookie belongs to an employee or an attacker who forged it. SIEM correlation rules built around failed logins, impossible-travel geolocation or MFA prompts have nothing to alert on, because MFA was never invoked. EDR running on endpoints behind the VPN sees Cobalt Strike beacons and BloodHound queries eventually, but by the time those tools execute, the attacker already holds a trusted network position that predates any endpoint alert.

This is a gap in what the logs mean, not a gap in what they contain. Teams that treat a successful GlobalProtect connection as inherently trustworthy are extending that trust to anyone holding a forged authentication override cookie, which is exactly the asymmetry Qilin and Settra are exploiting.

NVD's 9.1 score clashes with Palo Alto's 7.8

Infosecurity Magazine's October 12 report flags a scoring discrepancy worth noting for anyone triaging by CVSS alone: Palo Alto rates CVE-2026-0257 at 7.8, while NVD has it at a critical 9.1.

The mitigation itself has not changed since May. Unit 42's October update recommends using a dedicated certificate for authentication override cookie operations rather than reusing the HTTPS service certificate, or disabling the authentication override cookie feature entirely if it is not required for the environment. Cal-CSIC's advisory repeats the same guidance three months later.

What to check before the next patch window

Three changes come directly out of the reporting above, not from general VPN hygiene advice. First, audit whether authentication override cookies are enabled on any GlobalProtect portal or gateway, and whether the certificate backing them is shared with the HTTPS service — that shared-certificate configuration is the specific condition Palo Alto's advisory and Seceon's writeup both point to as exploitable. Second, stop treating a successful gateway-connected event as equivalent to an authenticated session for alerting purposes; correlate it instead against the user's known device fingerprint and prior session history, since the bypass produces a valid-looking connection with no prior session to match. Third, check ESXi hosts reachable from VPN-adjacent segments for execInstalledOnly status and verify Veeam patch levels against CVE-2023-27532, because both were used in the same intrusion chain documented by eSecurity Planet and are cheaper to fix than the VPN bypass itself if the gateway can't be patched immediately.

The fix for CVE-2026-0257 has existed since May 13; the patch itself has not changed since.

Links Verified at Time of Publish.

Sources

This article was reported from the following sources.

1. CVE-2026-0257 PAN-OS: GlobalProtect Authentication Bypass Vulnerabilities — Palo Alto Networks Security Advisories, 2026-05-13
2. Active Exploitation of May 2026 PAN-OS CVE-2026-0257 (Updated October 20) — Palo Alto Networks Unit 42, 2026-10-20
3. Ransomware groups expand targeting of Palo Alto Networks vulnerability — Cybersecurity Dive, 2026-10-20
4. Ransomware Gangs Exploit GlobalProtect VPN Flaw — What to Check — eSecurity Planet, 2026-10-21
5. Cookie Crumbles: How Exploitation of CVE-2026-0257 Leads to Qilin Ransomware — Arctic Wolf Labs, 2026-07-20
6. Known Exploited Vulnerabilities Catalog — CISA, 2026-05-29
7. Authentication Vulnerability Identified Within Palo Alto Networks GlobalProtect Portal and Gateway — California Cybersecurity Integration Center (Cal-CSIC), 2026-08-11
8. Months-Old Palo Alto VPN Vulnerability Remains a Target for Ransomware Groups — Infosecurity Magazine, 2026-10-12
9. Ransomware Actors Exploit Palo Alto Global Protect Flaw for Stealthy VPN Access — Seceon, 2026-10-14
10. Qilin & INC Ransomware Exploit PAN-OS CVE-2026-0257 to Bypass MFA — Aviatrix, 2026-10-21