RANSOMWARE groups continue to target a high-severity vulnerability in Palo Alto Networks products, five months after a security patch was issued, according to ReliaQuest. CVE-2026-0257 is an authentication bypass affecting PAN-OS GlobalProtect and Prisma Access, impacting PAN-OS versions 10.2.0, 11.1.0, 11.2.0 and 12.1.0, as well as all Cloud NGFW instances and Prisma Access 10.2.0 and 11.2.0. Palo Alto Networks disclosed the flaw on 13 May 2026, assigning a CVSS of 7.8 and a “highest” urgency rating.
While patches were released, ReliaQuest notes multiple threat‑intelligence teams have observed exploitation attempts in recent months, including Rapid7 in late May, Unit 42 in June and Arctic Wolf in July, suggesting some systems remain unpatched.
ReliaQuest warns that the Qilin and Settra ransomware groups are actively exploiting CVE-2026-0257, often deploying offensive tools such as Cobalt Strike, BloodHound and SharpHound. Because access can originate through an organisation’s VPN, malicious activity may resemble legitimate remote work and go undetected until credential theft, lateral movement, data theft or ransomware deployment is underway.
Organisations still running vulnerable Palo Alto deployments are urged to upgrade affected versions, disable authentication override cookies where not required, terminate all active GlobalProtect sessions after patching and investigate unexpected connections—including sessions using hostnames like ‘kali’. ReliaQuest cautions that patching alone may not remove access already established before remediation.