ReliaQuest named Settra on the GlobalProtect cookie. Kill the session.

CVE-2026-0257 is KEV since 29 May, ransomware Known. ReliaQuest 9 Oct put Settra next to Qilin. Patching without terminating GlobalProtect sessions is not the close.

RWP Ventures · 2026-10-12 · event 2026-10-09 · 13 min read · priority 8.7

Do not collapse four facts.

1. The CVE is not new. Palo Alto published it 13 May 2026. CISA put it on KEV 29 May, due 1 June, knownRansomwareCampaignUse: Known. Catalog freeze this morning is still 2026.10.08 / 1739. CVE-2026-0257 is present. That is not a new KEV row.
2. Qilin on this cookie is older than ReliaQuest’s tweet. Arctic Wolf, 20 July, documented multiple June 2026 intrusions that went from CVE-2026-0257 to domain-wide Qilin encryption. Rapid7 saw successful cookie logons from 17 May. Unit 42’s 9 June brief saw gateway-connected events and no post-access movement in that brief. ReliaQuest is a campaign continuation, not the first Qilin join.
3. Settra on this CVE is ReliaQuest’s increment. Huntress’s Settra write-up (July retail, September manufacturing) did not confirm initial access. Huntress: “could not be confirmed.” ReliaQuest now puts Settra on 0257. Treat that join as REPORTED ReliaQuest, not as Huntress retroactively naming those two incidents. CyPro’s 11 October bulletin made the same split.
4. This is not yesterday’s AhsayCBS. [11 October](/posts/2026-10-11-ahsaycbs-cve-2026-105134-exploit/) was unauthenticated SYSTEM on a backup console, not on KEV. This is a five-month-old VPN cookie, already on KEV, already ransomware Known. Different product, different close.

The operator sentence ReliaQuest added, and the one that belongs on the ticket: upgrade is not enough. Terminate active GlobalProtect sessions after the build is in. A cookie minted before the hotfix still looks like a user.

What happened

13 May. Palo Alto: authentication bypass in the GlobalProtect portal and gateway. An attacker can bypass security restrictions and establish an unauthorized VPN connection. Required configuration: authentication-override cookies enabled and a specific certificate configuration. Workaround named in the advisory: a dedicated certificate for those cookies, or disable generate/accept cookie for authentication override. Do not reuse the portal/gateway HTTPS certificate. Panorama and Cloud NGFW: not impacted. Exploit maturity later ATTACKED. Advisory last updated 2 June.

17–29 May. Rapid7 MDR: successful cookie authentication across numerous customers, earliest 17 May. First wave used a generic admin cookie logon from Vultr; second wave 21 May assigned a VPN IP in some cases. Rapid7: 8 of 10 impacted MDR customers accepted the cookie without a full tunnel. CISA KEV 29 May, federal due 1 June. Palo Alto raised CVSS 4.0 from 4.7 to 7.8 the same day.

9 June. Unit 42: unidentified actor probing GlobalProtect; only a small portion of probed devices established VPN sessions; no post-access behavior in that brief. IoCs in that brief are a different set from ReliaQuest’s October list.

June / 20 July. Arctic Wolf: multiple distinct intrusions, CVE-2026-0257 as the consistent initial access, then domain-wide Qilin. Some encryption-only, some double-extortion. Arctic Wolf: some exploitation from hosts self-identifying as kali, overlapping source IPs across victims. That hostname is not ReliaQuest’s invention.

September. Huntress: two Settra incidents (retail July, manufacturing September). MeshAgent in both. September case: BYOVD gdrv.sys, C2 193.5.65[.]114. Initial access in those two cases: UNKNOWN. Huntress cited public reporting that Settra has used VPNs and stolen credentials. Huntress did not name CVE-2026-0257.

9 October 19:55 UTC. ReliaQuest @ReliaQuestTR: continues to observe 0257 exploitation; Qilin and Settra; Cobalt Strike / BloodHound / SharpHound in related activity; upgrade, disable unused auth-override cookies, terminate all active GlobalProtect sessions after patching, hunt unexpected connections including hostname kali. Patching “may not remove access established before remediation.” ReliaQuest assesses exploitation highly likely to continue over the next three months. IoCs listed: 216.245.184[.]150, 216.245.184[.]47, 216.245.184[.]110, 216.245.184.0.

11–12 October. Secondary write-ups (Cyber Security News 11 Oct, Infosecurity Magazine 12 Oct) carried the ReliaQuest update. Infosecurity’s product list incorrectly pulled Cloud NGFW into the affected set. Vendor text is the record: Cloud NGFW none/all. Do not inventory from the magazine table.

Why it matters

A forged GlobalProtect session is not an exploit that looks like an exploit in the SOC. It is a Cookie authentication in the GlobalProtect log, often as a local or generic identity, then HIP/getconfig if the tunnel comes up. ReliaQuest’s detection sentence is the operational one: the traffic originates on the organization’s own VPN. EDR that only watches “new external RDP” will miss it until BloodHound or the encryptor.

The KEV due date was 1 June. Five months later ReliaQuest is still watching ransomware groups use it. That is not a catalog event. It is an uptake event: unpatched or un-hunted GlobalProtect with auth-override cookies still on, sessions not killed after the hotfix.

Settra on this cookie, if ReliaQuest is right, closes a gap Huntress left open. Huntress had Settra, MeshAgent, and “VPN or credentials” as public reporting, not a CVE. ReliaQuest is the first source in this window to put Settra on 0257. That join is one vendor’s telemetry. It is enough to hunt GlobalProtect cookie logons in any estate that had Settra, Qilin, or an unpatched portal. It is not enough to rewrite Huntress’s two incidents.

An industrial or manufacturing network that terminates GlobalProtect in IT and then reaches engineering VLANs is still an IT VPN problem on this record until someone produces a process write. Huntress’s September Settra victim was a manufacturing firm. That was IT encryption at an industrial organization. ReliaQuest did not claim OT protocol or HMI impact.

Who / what is affected

Vendor fixed floors (any of the listed builds or later on that train): 12.1.4-h6 or 12.1.7; 11.2.4-h17 / 11.2.7-h14 / 11.2.10-h7 / 11.2.12; 11.1.4-h33 / 11.1.6-h32 / 11.1.7-h6 / 11.1.10-h25 / 11.1.13-h5 / 11.1.15; 10.2.7-h34 / 10.2.10-h36 / 10.2.13-h21 / 10.2.16-h7 / 10.2.18-h6. Check the exact maintenance string against the advisory table, not the major version. After the fix, GlobalProtect users must re-authenticate once; the firewall regenerates the cookie.

Technical context

RWP is not reproducing cookie forgery. Rapid7 published that analysis in May. Defenders need the class, not the script.

CVE-2026-0257 is CWE-565: the appliance decrypts an authentication-override cookie and trusts the fields (user, domain, host ID, client OS, timestamp) without an integrity check Rapid7 could find. If the same certificate that terminates HTTPS is also the cookie key, the public key is on the wire. The log artifact Rapid7 printed is gateway-auth,login,Cookie — not a password success.

Preconditions the vendor named, for inventory:

• GlobalProtect portal or gateway configured.
• Generate and/or Accept cookie for authentication override checked (portal Agent → Authentication; gateway Client Settings → Authentication Override).
• Cookie certificate shared with another feature (commonly the portal/gateway HTTPS cert).

That is exposure, not proof of compromise. Proof is a Cookie login that does not match a human session, a hostname that is not in the MDM inventory (kali, Unit 42’s GP-CLIENT / DESKTOP-GP01 / WINDOWS-LAPTOP-001), a host ID that is a dummy MAC (aa:bb:cc:dd:ee:ff), or post-VPN BloodHound / MeshAgent / Qilin / Settra.

ATT&CK mapping for the ticket, from public reporting — not a playbook:

Arctic Wolf’s Qilin hallmarks, for hunting if 0257 was the door: staging under C:\PerfLogs\, PsExec, password-protected encryptor, registry Run *[a-z]{6}, LSASS MiniDump to an .odt, ntdsutil IFM. Huntress Settra hallmarks: MeshAgent, RESTORE_FILES.txt, .locked / .locked_wip, reagentc /disable, domain-named _win64.exe. Do not merge the two families’ IoC sets because ReliaQuest named both on one CVE.

Threat / exploitation status

Confidence on the CVE, KEV row, vendor config/patch table, Rapid7 May exploitation, and Arctic Wolf Qilin join: high. Confidence that ReliaQuest is still seeing 0257 this month: moderate-high (primary is an X post, corroborated by Infosecurity 12 Oct quoting it; no ReliaQuest long-form IR with a victim census in this retrieval). Confidence that Settra specifically uses 0257: moderate (single source). Confidence that a patched firewall with unkilled sessions is still an incident: high on ReliaQuest’s and the vendor’s cookie-lifetime model.

What defenders should do

1. Inventory every GlobalProtect portal and gateway — on-prem, VM-Series, hybrid Prisma Access NGFW. Record the exact maintenance string. Treat anything below the vendor floors above as in if auth-override cookies are on. A “PAN-OS patched” ticket that names only the major version is not proof.
2. If cookies are required: dedicated certificate, never the HTTPS cert, never reused from another feature. Vendor: if it was used elsewhere, generate a new one. If cookies are not required: uncheck generate/accept. That is the workaround that does not wait on a change window.
3. Upgrade all portals and gateways that mint or accept cookies together. Vendor FAQ: mixed-version cookie HMAC will break users. Temporary CLI set global-protect enable-auth-override-cookie-hmac no is a transition control; turn HMAC back on when the fleet is on a fixed build. Users re-authenticate once after the fix.
4. Terminate all GlobalProtect sessions after the build is in. ReliaQuest: patching may not drop a session established before remediation. Then hunt. Cookie logons for admin or other generic identities; hostnames kali, GP-CLIENT, DESKTOP-GP01, WINDOWS-LAPTOP-001; dummy MACs; ReliaQuest 216.245.184[.]150/.47/.110; Unit 42 May IPs; Arctic Wolf kali-session IPs from the July appendix. A hostname is a lead, not attribution.
5. If a Cookie session is unexplained: assume the VPN was the door and hunt inside. BloodHound/SharpHound, Cobalt Strike, MeshAgent, AnyDesk, C:\PerfLogs, Qilin/Settra notes, LSASS dumps, ntdsutil IFM. Rotate credentials that session could have touched. Do not close from “we applied 11.2.12.”
6. Keep yesterday’s tickets on the board. AhsayCBS 10.3.4.45 is still the close for [105134](/posts/2026-10-11-ahsaycbs-cve-2026-105134-exploit/). Integrity Tech five KEV rows were due 11 October. Apple CVE-2026-86950 is due 13 October. This cookie does not retire those.

RWP assessment

Score 8.7.

Highest-leverage development since yesterday’s Ahsay hotfix is a second ransomware family named on a KEV GlobalProtect cookie that federal clocks already expired in June, with ReliaQuest’s explicit close that session teardown is part of remediation. Evidence quality is high on the vendor advisory, KEV JSON, Rapid7, Arctic Wolf Qilin, and Huntress Settra-as-a-family. Evidence quality is intentionally split on ReliaQuest’s Settra-on-0257 join (one X post, no census) and on how many GlobalProtect portals remain on the required configuration (no public count in this retrieval).

It outranks a second day on AhsayCBS because [yesterday](/posts/2026-10-11-ahsaycbs-cve-2026-105134-exploit/) already carried Huntress SYSTEM, the 10.3.4.0 walk-back, and 10.3.4.45; overnight KEV did not add 105134. It outranks SonicWall SMA1000 CVE-2026-102255 because that CVSS 10 still has no KEV row and no confirmed appliance compromise in vendor text. It outranks a third day on Integrity Tech because [9 October](/posts/2026-10-09-integrity-tech-aa26-281a-kev/) assessed the five-row add; catalog freeze is unchanged. It outranks BotSharp CVE-2026-108860 (hard-coded JWT, CVSS 9.3, 11 October, no exploitation claimed). It outranks Exchange CVE-2026-96940 V2 because MSRC still says not exploited.

What we are not saying: that Settra-on-0257 is independently confirmed; that ReliaQuest published a victim count; that every 0257 intrusion runs Cobalt Strike; that Cloud NGFW is in; that Huntress’s two Settra cases used this CVE; that a manufacturing victim is confirmed OT impact; that this is a new KEV addition.

What we are watching

• Whether ReliaQuest, Unit 42, or Arctic Wolf publishes a long-form October IR with a Settra victim increment or a second source on the 0257 join.
• Whether CISA refreshes the 0257 KEV notes (ransomware Known is already set). Catalog freeze remains 2026.10.08.
• Whether Ahsay CVE-2026-105134 / 105133 land on KEV.
• SonicWall CVE-2026-102255: honeypot attempts vs confirmed compromise vs KEV.
• Apple CVE-2026-86950 due 13 October.
• NetScaler CVE-2026-107406 still not on KEV after [10 October](/posts/2026-10-10-netscaler-cve-2026-107406-saml/).

Sources

• ReliaQuest Threat Research — X, 9 October 2026 19:55 UTC
• Palo Alto Networks — CVE-2026-0257
• CISA KEV JSON catalog 2026.10.08
• CISA Known Exploited Vulnerabilities Catalog
• Unit 42 — Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257
• Rapid7 — Observed Exploitation of CVE-2026-0257
• Arctic Wolf — Cookie Crumbles: CVE-2026-0257 to Qilin
• Huntress — Ready, Settra, Go
• Infosecurity Magazine — Months-Old Palo Alto VPN Vulnerability Remains a Target (12 October 2026)
• NVD CVE-2026-0257
• [RWP — AhsayCBS Daily Top, 11 October 2026](/posts/2026-10-11-ahsaycbs-cve-2026-105134-exploit/)
• [RWP — Integrity Tech AA26-281A Daily Top, 9 October 2026](/posts/2026-10-09-integrity-tech-aa26-281a-kev/)