Palo Alto Networks’ GlobalProtect vulnerability CVE-2026-0257 has been exploited by the ransomware groups Qilin and INC, while claims of responsibility for attacks on Japanese companies and Settra’s involvement have been reported. Work is also progressing on organizing information about the vulnerability, countermeasures, and domestic cases.
Palo Alto Networks’ threat research unit Unit 42 updated its information on the exploitation of the GlobalProtect authentication-bypass vulnerability CVE-2026-0257 on 19 October 2026, reporting that Qilin and INC Ransom had been confirmed as attackers. External reports have also cited information that Settra is using the vulnerability, and domestic cases related to claims of responsibility for attacks on Japanese companies have been compiled.
CVE-2026-0257 affects PAN-OS GlobalProtect portals and gateways when an authentication-override cookie is enabled and a specific certificate configuration is present. A patch was released in May 2026, and Rapid7 observed exploitation in multiple customer environments from 17 May onward. The vulnerability was also added to CISA’s Known Exploited Vulnerabilities catalog on 29 May.
Unit 42’s investigation indicated the possibility of internal reconnaissance, lateral movement, data exfiltration, and ransomware execution after the initial intrusion. Examples included movement from VPNs to virtualization infrastructure, access to VMware vCenter management environments, and the acquisition of credentials via VMDK files. Activity combining the vulnerability with a separate Veeam vulnerability has also been confirmed.
In Japan, claims of responsibility by Qilin and Settra have been covered. Qilin has claimed attacks affecting Japanese organizations, while Settra has disclosed an attack on アンビションDXホールディングス. Neither claim definitively establishes CVE-2026-0257 as the intrusion route, and the diversity of actual attack paths has been emphasized.