CVE-2026-0257: GlobalProtect VPN Exploited by Ransomware

ReliaQuest’s October 11 update confirms the Qilin and Settra ransomware operations are exploiting CVE-2026-0257, an authentication bypass in Palo Alto Networks' GlobalProtect VPN, forging authentication cookies to open fully authorized sessions without credentials. Where a portal reuses its TLS certificate to encrypt the authentication cookie, the public key from an ordinary handshake is enough to mint a session as any user, administrators included; exploitation has been running since mid-May 2026.