Ransomware crews are still breaking into Palo Alto firewalls through a patched VPN flaw
Palo Alto Networks says Qilin, Inc and Settra operators keep probing CVE-2026-0257 months after the May patch, with CISA holding federal agencies to a June 1 fix deadline.
Key points - Palo Alto Networks has named Qilin and Inc ransomware crews as actively exploiting CVE-2026-0257, an authentication bypass in PAN-OS GlobalProtect. - CISA added the flaw to its Known Exploited Vulnerabilities catalogue in late May 2026, with a federal patch deadline of June 1, 2026. - The bug carries a CVSS score of 7.8 and lets attackers open an unauthorised VPN session without valid credentials. - Panorama and Cloud NGFW are not affected, according to the NVD record. - Palo Alto Networks has also pointed to public reporting tying the same flaw to operators of a third strain, Settra.
Palo Alto Networks' threat research unit says ransomware crews are still trying to force their way into customer firewalls using a flaw the company patched back in May.
The bug is CVE-2026-0257, an authentication bypass in the GlobalProtect portal and gateway of PAN-OS. GlobalProtect is the remote-access VPN that lets staff log in to a company network from outside the office. The flaw lets an attacker skip that login check and open a VPN session as if they belonged there. We first covered this vulnerability on 30 May 2026, and reported earlier this month that a small number of exploitation attempts had already succeeded.
Palo Alto has named the crews it is seeing in the traffic: Spikey Scorpius, which it says is the group better known as Qilin, and Tarnished Scorpius, which it tracks as Inc. The company also pointed to public reporting tying the same flaw to operators of a third strain, Settra.
What exactly is the flaw?
It's an authentication bypass, scored 7.8 (high) on the CVSS severity scale. The NVD entry states that the issue sits in GlobalProtect's portal and gateway components, and that Panorama and Cloud NGFW are not impacted. Palo Alto reports that only a small share of probed devices actually went on to establish a VPN session, and that follow-on activity like lateral movement hasn't shown up in its telemetry so far.
That last point matters. The hackers are getting a foot in the door on some firewalls. What they do next, on the networks behind those firewalls, has not yet appeared in Palo Alto's data.
What are regulators requiring?
US federal civilian agencies were ordered to patch by June 1, 2026. Private operators aren't bound by that directive, but the KEV listing is widely used by insurers and auditors as the point at which a flaw is treated as live, exploited risk rather than theoretical.
How active are these ransomware groups?
Qilin has been running hard. Our September coverage of Storm-2570 showed how a single affiliate was cycling through Qilin and other crews using the same toolkit, and the pace hasn't let up: a suspect was arrested in Japan and extradited to Germany earlier this month over a Qilin-linked extortion. A high-severity authentication bypass in a widely deployed VPN appliance is exactly the kind of entry point ransomware affiliates favour, and months after the fix, Palo Alto is telling customers the probing has not stopped.
These are claims the gangs post on their own extortion sites, so they should be read as allegations rather than confirmed breaches, and they don't establish that any particular victim was hit through this flaw.
If the May update isn't on your GlobalProtect-facing devices yet, you're the target audience for this advisory.
