A GlobalProtect flaw patched in May is working for ransomware crews. ReliaQuest has Qilin and Settra both using CVE-2026-0257, an authentication bypass, to open VPN sessions that look like remote work. Exposure depends on configuration: the authentication override cookie feature plus a particular certificate setup, so not every estate is affected. Fixes have been out since 13 May at the vendor's highest urgency. Panorama and Cloud NGFW are unaffected. ReliaQuest found Cobalt Strike and BloodHound after the connections, so the detection surface sits after a successful login, not at it. None of this needs a new CVE; it needs the May one applied. https://security.paloaltonetworks.com/CVE-2026-0257 #CyberSecurity #InfoSec #Ransomware