Qilin ransomware affiliates are systematically exploiting CVE-2026-0257, an authentication bypass in Palo Alto Networks PAN-OS, to gain initial access before deploying ransomware across victim networks. Arctic Wolf Labs, which investigated multiple confirmed intrusions in June and July 2026, found that attackers moved from perimeter compromise to domain-wide encryption in hours, not days. The volume and pace of intrusions signal coordinated affiliate activity under Qilin’s ransomware-as-a-service umbrella.
Vulnerability Details
CVE-2026-0257 affects the GlobalProtect portal and gateway components of Palo Alto PAN-OS. The flaw is exploitable when authentication override cookies are enabled alongside specific certificate configurations — a combination present in many enterprise deployments. Successful exploitation allows an unauthenticated remote attacker to bypass authentication entirely and establish a valid VPN session without credentials.
The vulnerability carries a CVSS score of 7.8. Palo Alto Networks issued a patch on 13 May 2026. Rapid7 observed active exploitation beginning 17 May, four days after the patch release, and the exploitation window has remained open as organisations have been slow to update perimeter appliances.
Affected versions include PAN-OS 10.2, 11.1, 11.2, and 12.1 prior to their respective patched builds, along with certain Prisma Access releases.
Attack Pattern
Arctic Wolf’s intrusion analysis reveals a consistent post-exploitation sequence. Following initial access via GlobalProtect, threat actors conducted rapid network reconnaissance and moved to Active Directory to harvest credentials. In several incidents, time from initial compromise to deployment of ransomware payloads was under eight hours.
Post-exploitation tradecraft varied across the investigated intrusions, ranging from encryption-only operations targeting maximum disruption speed to full double-extortion campaigns that included data exfiltration before encryption. The variation in approach is consistent with multiple affiliates operating under the Qilin RaaS model rather than a single tightly coordinated group.
Sectors confirmed affected in intrusion investigations include healthcare, legal, and financial services. Given the prevalence of Palo Alto GlobalProtect as an enterprise VPN platform across critical infrastructure, transport, and communications organisations, defenders in all sectors should treat this as high priority.
Implications for Affected Sectors
GlobalProtect is one of the most widely deployed enterprise VPN platforms. A successful bypass does not require user interaction: the attacker only needs network access to the GlobalProtect portal interface, which is typically internet-facing by design. This makes the vulnerability broadly and easily exploitable at scale.
The speed of the attack chain from perimeter access to ransomware deployment is the operational risk. An eight-hour window is too short for most security operations teams to detect and contain an intrusion without automated alerting on new VPN sessions or anomalous authentication events.
For healthcare organisations specifically, which frequently run PAN-OS for secure remote access to clinical systems, an encryption event that moves at this speed can disrupt patient care before a containment decision is made.
Recommended Actions
-
Patch immediately. Upgrade all PAN-OS instances to versions that address CVE-2026-0257. Prioritise internet-facing GlobalProtect deployments. Check Prisma Access configurations for affected releases.
-
Audit authentication override cookie settings. The vulnerability is only exploitable under specific certificate and cookie configurations. Verify whether your GlobalProtect deployment uses authentication override cookies; if so, assess whether the configuration can be changed pending patching.
-
Alert on new VPN sessions. Configure SIEM rules to flag new or unusual VPN session establishment, particularly sessions from unfamiliar source IPs or in off-hours periods. This is the primary detection opportunity in the initial access phase.
-
Review Active Directory exposure. Given the rapid pivot to AD in confirmed intrusions, ensure that AD privileged access is not reachable from workstations accessible to newly authenticated VPN users without additional authentication controls.
-
Check for existing compromise. Organisations running unpatched PAN-OS have been in the exploit window since May. Review VPN authentication logs for anomalous sessions dating back to mid-May 2026.