High 7.8
KEV + Ransomware
CVE-2026-0257
Exploitation of Palo Alto Networks GlobalProtect Vulnerability CVE-2026-0257 by Qilin and Settra Ransomware Groups
Vendor / product: Palo Alto Networks PAN-OS GlobalProtect, Prisma Access
Event date: 2026-05-29
Public PoC: Yes
First tracked by RiskWire: 2026-10-11
CISA KEV catalog
Added to KEV
Federal remediation due
2026-06-01 (132 days overdue)
Ransomware campaign use
Known
CISA description
Palo Alto Networks PAN-OS contains an authentication bypass vulnerability that allows attackers to bypass security restrictions and establish an unauthorized VPN connection.
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Named threat actors
QilinSettra
Sources & citations (1)
- Ransomware Actors Exploiting Palo Alto GlobalProtect Flaw for Stealthy VPN Access cybersecuritynews.com · 2026-10-11
References
See CVE-2026-0257 in context
RiskWire tracks every exploited CVE this week, cross-referenced against CISA KEV with federal remediation deadlines. Filtered to your vendor stack.
Book a 20-min demo →