Qilin ransomware affiliates are systematically exploiting CVE-2026-0257, an authentication bypass in Palo Alto Networks PAN-OS, to gain initial access before deploying ransomware across victim networks. Arctic Wolf Labs, which investigated multiple confirmed intrusions in June and July 2026, found that attackers moved from perimeter compromise to domain-wide encryption in hours, not days. The volume and pace of intrusions signal coordinated affiliate activity under Qilin’s ransomware-as-a-service umbrella.
Vulnerability Details
CVE-2026-0257 affects the GlobalProtect portal and gateway components of Palo Alto PAN-OS. The flaw is exploitable when authentication override cookies are enabled alongside specific certificate configurations — a combination present in many enterprise deployments. Successful exploitation allows an unauthenticated remote attacker to bypass authentication entirely and establish a valid VPN session without credentials.
The vulnerability carries a CVSS score of 7.8. Palo Alto Networks disclosed and patched the flaw on 13 May 2026, with an advisory update following on 29 May. CISA added the CVE to its Known Exploited Vulnerabilities catalog on 29 May with a federal remediation deadline of 1 June. Rapid7 documented exploitation in at least two distinct waves: an initial wave around 18 May using Vultr-hosted infrastructure (observed connecting from a machine identified as GP-CLIENT with a spoofed MAC address aa:bb:cc:dd:ee:ff and local admin authentication), and a second wave around 21 May from Dromatics Systems hosting infrastructure with full VPN IP assignment to the attacker.
Affected versions include PAN-OS 10.2, 11.1, 11.2, and 12.1 prior to their respective patched builds (including 11.1.4-h33 and 10.2.7-h34 among the fixed releases), along with certain Prisma Access releases. PAN-OS 9.0, 9.1, and 10.0 are end-of-life and will not receive a patch — any organisation still running those branches has no vendor remediation path and should prioritise migration or network isolation.
Attack Pattern
Arctic Wolf’s intrusion analysis reveals a consistent post-exploitation sequence. Following initial access via GlobalProtect, threat actors conducted rapid network reconnaissance and moved to Active Directory to harvest credentials. In several incidents, time from initial compromise to deployment of ransomware payloads was under eight hours.
Post-exploitation tradecraft varied across the investigated intrusions, ranging from encryption-only operations targeting maximum disruption speed to full double-extortion campaigns that included data exfiltration before encryption. The variation in approach is consistent with multiple affiliates operating under the Qilin RaaS model rather than a single tightly coordinated group.
Sectors confirmed affected in intrusion investigations include healthcare, legal, and financial services. Given the prevalence of Palo Alto GlobalProtect as an enterprise VPN platform across critical infrastructure, transport, and communications organisations, defenders in all sectors should treat this as high priority.
Implications for Affected Sectors
GlobalProtect is one of the most widely deployed enterprise VPN platforms. A successful bypass does not require user interaction: the attacker only needs network access to the GlobalProtect portal interface, which is typically internet-facing by design. This makes the vulnerability broadly and easily exploitable at scale.
The speed of the attack chain from perimeter access to ransomware deployment is the operational risk. An eight-hour window is too short for most security operations teams to detect and contain an intrusion without automated alerting on new VPN sessions or anomalous authentication events.
For healthcare organisations specifically, which frequently run PAN-OS for secure remote access to clinical systems, an encryption event that moves at this speed can disrupt patient care before a containment decision is made.
Recommended Actions
-
Patch immediately. Upgrade all PAN-OS instances to versions that address CVE-2026-0257. Prioritise internet-facing GlobalProtect deployments. Check Prisma Access configurations for affected releases.
-
Audit authentication override cookie settings. The vulnerability is only exploitable under specific certificate and cookie configurations. Verify whether your GlobalProtect deployment uses authentication override cookies; if so, assess whether the configuration can be changed pending patching.
-
Alert on new VPN sessions. Configure SIEM rules to flag new or unusual VPN session establishment, particularly sessions from unfamiliar source IPs or in off-hours periods. This is the primary detection opportunity in the initial access phase.
-
Review Active Directory exposure. Given the rapid pivot to AD in confirmed intrusions, ensure that AD privileged access is not reachable from workstations accessible to newly authenticated VPN users without additional authentication controls.
-
Check for existing compromise. Organisations running unpatched PAN-OS have been in the exploit window since May. Review VPN authentication logs for anomalous sessions dating back to mid-May 2026.