Our takeReliaQuest reports that Qilin and Settra ransomware groups are still exploiting the Palo Alto VPN flaw patched in May. If you have not patched this older CVE, you remain exposed and should patch now.Security Resilience desk
Sources (4)
- infosec_mag · infosec_mag
- hkcert · hkcert
- cert_bund · cert_bund
- the420_in · the420_in
What this means for you — Security leader:Apply the May 2026 PAN-OS patch for CVE-2026-0322 immediately on all internet-facing management interfaces; the flaw still sees active exploitation by Qilin and Settra ransomware operators.
What this means for you — Lean IT orgs:If you run Palo Alto firewalls, check that you are on a version released in May 2026 or later and apply the update now; this vulnerability is still being used by ransomware groups.
What this means for you — MSP:Confirm that all Palo Alto firewall clients are running a version patched in or after May 2026 for CVE-2026-0322; the vulnerability remains an active ransomware vector across multiple managed environments.
What this means for you — Researcher:Qilin and Settra ransomware groups continue to exploit the PAN-OS management-interface flaw (CVE-2026-0322) that Palo Alto fixed in May; monitor for ongoing exploitation attempts.