# PAN-OS GlobalProtect/Prisma Access Authentication Bypass CVE-2026-0257 Exploited by Qilin and Settra Ransomware (ThreatsDay Bulletin: SiteGuard WAF CVE-2026-106931, Adobe AEM RCE Chain, Noir Wallet Drainer)

> CVE-2026-0257, a forged authentication-override-cookie bypass in Palo Alto Networks PAN-OS GlobalProtect and Prisma Access, is being used by the Qilin and Settra ransomware operations to obtain unauthorized VPN sessions, roughly 149 days after the 2026-05-13 patch. The same 2026-10-15 Hacker News bulletin reports in-the-wild exploitation of EG Secure SiteGuard Server Edition CVE-2026-106931 and covers an Adobe AEM RCE chain, the Noir wallet drainer and several RATs and infostealers.

- **Published:** 2026-10-15T19:22:49Z
- **Last reviewed:** 2026-10-15T19:22:49Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3657
- **ID:** TL-2026-3657
- **Severity:** CRITICAL (CVSS 7.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Actor:** Qilin
- **Detections:** 9 · **IOCs:** 21 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-0257, CVE-2026-106931, CVE-2026-110392, CVE-2026-108065, CVE-2026-47595, CVE-2026-101341, CVE-2026-101339, CVE-2026-101338, CVE-2026-101337, CVE-2026-79610

## Description

CVE-2026-0257 (CWE-565, CVSS 4.0 score 7.8; Palo Alto Networks raised it from 4.7 after Rapid7 published a working proof of concept on 2026-05-29) affects the GlobalProtect portal and gateway on PAN-OS 12.1, 11.2, 11.1 and 10.2 and on Prisma Access 11.2 and 10.2. Cloud NGFW and Panorama are not affected. Exploitation needs three conditions: GlobalProtect portal or gateway enabled, authentication override cookies enabled (non-default), and the certificate that protects those cookies reused for another exposed service such as the public HTTPS portal. An unauthenticated remote attacker can retrieve the public certificate, forge an authentication override cookie for an arbitrary user, and establish a GlobalProtect VPN session without valid credentials. The session looks like a legitimate remote-access connection, which helps the attacker blend in.

Palo Alto Networks published the advisory on 2026-05-13 and the first exploit attempts were seen on 2026-05-17, with a second wave on 2026-05-21 that Rapid7 assessed as the same actor. The flaw was added to CISA KEV on 2026-05-29 (federal deadline 2026-06-01). Arctic Wolf reported increased exploitation in early June and documented forged administrator credentials, rapid configuration retrieval, IPsec tunnel establishment and lateral movement with Impacket and NTLM relay, from VPN clients with the hostname 'kali'. In October 2026 ReliaQuest reported that multiple groups, including the Qilin ransomware-as-a-service operation (active since 2022) and Settra (first seen June 2026), were exploiting the flaw against unpatched devices. Secondary reporting says operators then deployed Cobalt Strike, BloodHound and SharpHound for Active Directory mapping, and moved through Windows admin shares toward domain-wide encryption. ReliaQuest assessed that exploitation was highly likely to continue over the next three months. Unit 42 is credited in the bulletin for PAN-OS exploitation reporting.

The source bulletin (The Hacker News, 2026-10-15) also covers: in-the-wild exploitation of a command injection in EG Secure SiteGuard Server Edition (CVE-2026-106931, CVSS 8.5, v2.20+); an unauthenticated four-flaw RCE chain in Adobe Experience Manager Cloud (DAM import, XSS, unsafe XML handling, Groovy execution, since patched); Samsung QA-Board CVE-2026-110392 (CVSS 9.8, unauthenticated RCE); Channel Software WebAlliance eCommerce CVE-2026-108065 (CVSS 9.8 SQL injection, no patch announced); NSD DNS server code-execution flaws CVE-2026-101337/101338/101339/101341 (fixed in 4.15.3+); NVIDIA Linux GPU driver CVE-2026-47595 'Bad UVM' container escape; Xen grant-table race CVE-2026-79610; the Noir wallet drainer, which resolves its backend through DNS TXT records over DoH; and the CikaBika Bot, KGB RAT, BotHelper RAT, XWorm, Warden Stealer, Aoki and CastleStealer malware families. CVE-2026-106931, CVE-2026-110392 and the Adobe chain could not be independently confirmed outside the bulletin during this research and should be treated as single-source. The Qilin/Settra attacker IPs from Arctic Wolf (June 2026 activity) and from a secondary October write-up differ and are recorded separately with their provenance.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1550.004 Web Session Cookie
- T1078 Valid Accounts
- T1087.002 Domain Account
- T1069.002 Domain Groups
- T1557 Adversary-in-the-Middle
- T1021.002 SMB/Windows Admin Shares
- T1071.004 DNS
- T1053.005 Scheduled Task
- T1685 Disable or Modify Tools
- T1036.005 Match Legitimate Resource Name or Location
- T1113 Screen Capture

## Sources

- [ThreatsDay Bulletin - The Hacker News](https://thehackernews.com/2026/10/threatsday-adobe-rce-dns-wallet-theft.html)
- [Palo Alto Networks Security Advisory CVE-2026-0257](https://security.paloaltonetworks.com/CVE-2026-0257)
- [PAN-OS GlobalProtect Authentication Bypass Exploited - The Hacker News](https://thehackernews.com/2026/05/pan-os-globalprotect-authentication.html)
- [Arctic Wolf Security Bulletin: CVE-2026-0257 PAN-OS GlobalProtect Authentication Bypass](https://arcticwolf.com/resources/blog/cve-2026-0257-pan-os-globalprotect-authentication-bypass/)
- [Palo Alto GlobalProtect VPN Auth Bypass Flaw Now Exploited in Attacks - BleepingComputer](https://www.bleepingcomputer.com/news/security/palo-alto-globalprotect-vpn-auth-bypass-flaw-now-exploited-in-attacks/)
- [ReliaQuest Threat Research: Qilin and Settra exploiting CVE-2026-0257](https://x.com/ReliaQuestTR/status/2108647641240465707)
- [CVE-2026-0257: GlobalProtect VPN Flaw Hit by Ransomware - OpenVPN Blog](https://blog.openvpn.net/palo-alto-globalprotect-cve-2026-0257-ransomware)
- [CVE-2026-0257: GlobalProtect VPN Exploited by Qilin and Settra - Decryption Digest](https://www.decryptiondigest.com/blog/globalprotect-cve-2026-0257-qilin-settra-ransomware)
- [Active Exploitation of PAN-OS GlobalProtect Auth Bypass Flaw - Ampcus Cyber (Rapid7 PoC summary)](https://www.ampcuscyber.com/shadowopsintel/active-exploitation-pan-os-globalprotect-auth-bypass-flaw/)
- [Noir Wallet Drainer Uses DNS to Keep Fake Crypto Pages Working - GridinSoft (Infoblox findings)](https://blog.gridinsoft.com/noir-wallet-drainer-dns-permissions/)
- [BotHelper RAT gives attackers live Windows screen access](https://thearabianpost.com/bothelper-rat-gives-attackers-live-windows-screen-access/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3657