A critical authentication bypass vulnerability in Palo Alto Networks PAN-OS GlobalProtect (CVE-2026-0257) has progressed from limited exploitation to confirmed use in Qilin ransomware attacks. The flaw allows attackers to establish unauthorized VPN sessions by bypassing authentication under specific GlobalProtect configurations, effectively granting remote network access without valid user credentials.
While Palo Alto Networks released patches on May 13, Rapid7 observed exploitation within days, CISA added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog on May 29, and Arctic Wolf has now documented multiple June 2026 incidents where exploitation led to full domain compromise and enterprise-wide ransomware deployment.
CISA has also confirmed the vulnerability is being exploited in ransomware attacks.
For organizations using GlobalProtect, this vulnerability has been observed as the initial access vector in Qilin ransomware attacks.
Why It Matters: The campaign demonstrates how quickly attackers can weaponize internet-facing infrastructure. Once inside, operators consistently escalated privileges, harvested credentials, moved laterally across Windows environments, and in many cases disabled recovery options before encrypting systems. Organizations should assume that successful exploitation may result in complete Active Directory compromise unless proven otherwise.
- Authentication Bypass Risk: CVE-2026-0257 enables unauthorized GlobalProtect VPN access when authentication override cookies are configured under specific certificate scenarios. Because attackers establish what appear to be legitimate VPN sessions, organizations should not assume MFA or standard authentication monitoring alone will prevent or detect compromise.
- Enterprise-Wide Compromise: Investigators consistently observed LSASS dumping, Active Directory database extraction (NTDS.dit), credential theft, and lateral movement using PsExec, RDP, and administrative shares before enterprise-wide ransomware deployment.
- Affiliate Attack Patterns: While all observed intrusions began with the same vulnerability, post-compromise activity differed. Some affiliates rapidly encrypted systems, while others conducted reconnaissance, deployed remote access tools, exfiltrated data, and executed double-extortion campaigns.
- Recovery and Evasion: Attackers cleared Windows event logs, disabled Microsoft Defender in some environments, targeted Veeam backup infrastructure, and staged ransomware from the commonly overlooked C:\PerfLogs\ directory to hinder detection and recovery.
- Immediate Response Priorities. Organizations should patch affected PAN-OS versions, terminate active GlobalProtect sessions after patching, review VPN logs for anomalous sessions, and, if compromise is suspected, rotate privileged credentials and initiate a full incident response investigation.
Go Deeper -> Critical Palo Alto VPN bug now exploited by Qilin ransomware gang – BleepingComputer
Cookie Crumbles: How Exploitation of CVE-2026-0257 Leads to Qilin Ransomware – Arctic Wolf Labs
Trusted insights for technology leaders
Our readers are CIOs, CTOs, and senior IT executives who rely on The National CIO Review for smart, curated takes on the trends shaping the enterprise, from GenAI to cybersecurity and beyond.
Subscribe to our 4x a week newsletter to keep up with the insights that matter.
