---
title: Unit 42: Qilin and Inc ransomware operators are exploiting PAN-OS GlobalProtect auth bypass CVE-2026-0257; Settra also reported | ctxsec
url: https://ctxsec.com/items/reliaquest-qilin-settra-0257
description: ""
status: "confirmed (Palo Alto Unit 42 update Oct 19); CISA KEV since May 13, last updated Oct 20, 2026, ~8:20 AM ET (corrected: Unit 42 update does list post-access TTPs)"
published: 2026-10-19
updated: 2026-10-20T08:20:00-04:00
---

> 

[← Cybersecurity News](/news) · [markdown](/items/reliaquest-qilin-settra-0257.md)

confirmed (Palo Alto Unit 42 update Oct 19); CISA KEV since May 13

2026-10-19 · updated

Oct 20, 2026, ~8:20 AM ET (corrected: Unit 42 update does list post-access TTPs)

### Unit 42: Qilin and Inc ransomware operators are exploiting PAN-OS GlobalProtect auth bypass CVE-2026-0257; Settra also reported

Palo Alto Networks Unit 42 updated its CVE-2026-0257 threat brief on Oct 19. It says it continues to see attempted exploitation by ransomware operators, including Spikey Scorpius (Qilin) and Tarnished Scorpius (Inc), and notes ReliaQuest's public reporting that actors using Settra ransomware are exploiting it too. CVE-2026-0257 is an authentication bypass in the GlobalProtect portal and gateway that lets an attacker start unauthorized VPN sessions. It has been in CISA KEV since May 13, 2026, and a public PoC appeared May 29. Unit 42's Oct 19 update (4:00 PM PT) also lists what follows access: RMM-tool recon, RDP/SMB lateral movement and staging for credential theft, exfiltration and ransomware. In one case the attackers pivoted to vCenter, disabled ESXi `execInstalledOnly`, and dumped domain credentials offline from a domain controller's VMDK. See our [virtualization-layer hunt](/hunting#hunt-pan-os-0257-vcenter-esxi-vmdk-pivot).

**Do now:** confirm GlobalProtect is on a fixed PAN-OS release or has the advisory's mitigations in place. Then hunt GlobalProtect logs for successful gateway-connected events with placeholder host IDs or device names (`aa:bb:cc:dd:ee:ff`, `00:11:22:33:44:55`, `WINDOWS-LAPTOP-001`, `DESKTOP-GP01`, `GP-CLIENT`) or the PoC's hard-coded values (`endpoint_os_version` "Microsoft Windows 10 Pro 64-bit" with an empty `source_user_info.domain`). Treat any hit as an incident, since ransomware crews are now using this entry point.

Sources: [Unit 42 threat brief (updated Oct 19)](https://unit42.paloaltonetworks.com/active-exploitation-of-pan-os-cve-2026-0257/) · [Palo Alto CVE-2026-0257](https://security.paloaltonetworks.com/CVE-2026-0257) · [ReliaQuest (X)](https://x.com/ReliaQuestTR/status/2108647641240465707)