ReliaQuest published a threat update on 11 October naming the Qilin ransomware-as-a-service operation and a newer group it calls Settra as exploiting CVE-2026-0257, an authentication bypass in Palo Alto Networks' GlobalProtect.

Before anything else, the dates. Palo Alto disclosed this on 13 May 2026, scored 7.8. CISA added it to the Known Exploited Vulnerabilities catalogue on 29 May — we checked that against CISA's own feed rather than taking it from coverage. Exploitation has been observed since mid-May.

So this is not a new vulnerability, and a headline that reads as one is the wrong shape. Five months after disclosure, after a vendor advisory and a federal remediation deadline, it is still a working way into corporate networks.

What the flaw does

GlobalProtect can be configured to issue an authentication override cookie, so a user who has authenticated once is not challenged again for a period.

The bypass lets an unauthenticated attacker forge an authentication override cookie. The result is not a partial foothold or a crash. It is a fully authorised VPN session, with no credentials, belonging to whoever the attacker says it belongs to.

Exposure depends on configuration: the authentication override cookies have to be enabled on the portal or gateway, and the certificate used to sign them has to be reused or exposed. PAN-OS 10.2, 11.1, 11.2 and 12.1 branches are listed as affected. Panorama and Cloud NGFW are not. Reporting conflicts on whether Prisma Access deployments are in scope, so check the vendor advisory rather than any summary of it, including this one.

The part that is actually new

The useful finding in ReliaQuest's update is not the attribution. It is a line in the remediation advice: after patching, terminate all active GlobalProtect sessions.

That is there because the patch does not do it. A session established with a forged cookie before remediation is a legitimate session afterwards — the server has no way to distinguish it from one a real user opened. Patch the appliance, congratulate yourself, and the attacker stays logged in.

This is the same shape as a problem this site keeps running into from different directions. A deleted Kibana integration leaves its redirection in place. Removal, or patching, ends the mechanism. It does not undo what the mechanism did.

ReliaQuest also suggests looking for unexpected connections, including devices with hostnames such as kali — and is careful to call that an investigation lead rather than proof of anything. It is an attacker forgetting to rename a machine, which happens, and is not evidence on its own.

Who is using it

Qilin is the one to note. It appeared near the top of the most prolific groups in Comparitech's record third quarter, and here it is as the named operator of a five-month-old VPN bypass. Prolific and unoriginal are not in tension; they explain each other.

Settra is newer, first seen in June 2026, reported against consumer services, retail and manufacturing.

Post-access activity reported alongside it is entirely conventional: Cobalt Strike for command and control, BloodHound and SharpHound for mapping Active Directory. Earlier in the year Arctic Wolf traced several Qilin intrusions to this same entry point, with LSASS memory dumping, extraction of the Active Directory database and lateral movement through administrative shares.

There is no novelty anywhere in that chain. The novelty was the way in, and that was published in May.

Why the old ones keep working

Last week CISA added five identifiers to its exploited-vulnerabilities catalogue and three of them were from 2015 and 2016. This is that observation at a shorter range.

An internet-facing VPN appliance is the hardest thing in most estates to patch, because it is the thing everyone is connected through. The maintenance window is a business negotiation. Which means a flaw in that class has a long tail by default, and attackers who are reading the same advisories as the defenders know exactly how long.

What to do

  • Patch, then end every active GlobalProtect session. The second step is the one that evicts.
  • Check whether authentication override cookies are enabled at all. If the feature is not needed, the exposure goes away with it.
  • Rotate the certificate used to sign those cookies. A forged cookie implies the signing material is reusable.
  • Review GlobalProtect logs back to mid-May, not back to this week. That is when exploitation starts.
  • Treat any session that predates your patch as suspect rather than as history.

What is not established

  • Whether Prisma Access deployments are affected. Sources conflict and the vendor advisory is the only answer.
  • How many organisations have been reached this way. ReliaQuest describes activity, not a count.
  • Whether Qilin and Settra are related, beyond using the same entry point.
  • How the attackers obtain or forge the signing material in each case.
  • Whether the mid-May and June exploitation waves are the same operators as the October activity.