Security researchers have confirmed that a critical authentication bypass vulnerability in Palo Alto Networks’ GlobalProtect VPN software is now being actively used to deploy Qilin ransomware against corporate networks worldwide. The flaw, tracked as CVE-2026-0257, lets attackers slip past login controls entirely and establish what look like legitimate VPN sessions, without ever needing a valid username or password.
The disclosure marks a troubling escalation. What began in May as isolated exploitation attempts against unpatched systems has, over the course of June, evolved into a documented pattern of full network takeovers, with attackers moving from initial VPN access to domain-wide encryption in a matter of hours in some cases. Arctic Wolf Labs, the cybersecurity firm that uncovered the campaign, says the intrusions all trace back to the same entry point.
For IT and security teams, the timing could not be more urgent. Palo Alto Networks’ products are used by more than 70,000 organizations globally, including a large share of Fortune 100 companies and major financial institutions. With a working ransomware playbook now built around this single vulnerability, unpatched GlobalProtect deployments have effectively become an open door.
What Is CVE-2026-0257 and Why It Matters
CVE-2026-0257 is an authentication bypass vulnerability, carrying a CVSS score of 7.8, that affects both the GlobalProtect portal and gateway components of Palo Alto Networks’ PAN-OS software. The bug becomes exploitable in environments where authentication override cookies are enabled alongside certain certificate configurations, a combination common enough in enterprise deployments to have left a wide attack surface exposed.
Palo Alto Networks addressed the issue with a patch released on May 13. In its advisory at the time, the company warned that the GlobalProtect portal and gateway software allowed an attacker to bypass security restrictions and establish an unauthorized VPN connection. Just days later, cybersecurity firm Rapid7 reported observing active exploitation against customers starting around May 17, and the pattern has only accelerated since.
From Isolated Exploits to a KEV Listing
The vulnerability’s severity did not go unnoticed by federal regulators. The Cybersecurity and Infrastructure Security Agency added CVE-2026-0257 to its Known Exploited Vulnerabilities catalog on May 29, a designation reserved for flaws with confirmed real-world exploitation. That listing triggered an emergency directive requiring U.S. federal agencies to secure their GlobalProtect instances within three days, underscoring how seriously government cybersecurity officials viewed the risk.
Independent scans have since found well over 167,000 internet-facing GlobalProtect instances that could potentially be exposed to the flaw if left unpatched, a number that helps explain why the vulnerability attracted the attention of a ransomware operation looking for scale.
How the Attack Chain Unfolds
According to Arctic Wolf’s investigation into multiple June 2026 intrusions, every case followed a strikingly consistent pattern. Attackers first exploited CVE-2026-0257 to establish an authenticated-looking VPN session without credentials. From there, operators moved quickly to escalate privileges, dump credentials from LSASS memory, and extract the Active Directory database file known as NTDS.dit. Lateral movement across Windows environments typically relied on standard administrative tools including PsExec, RDP, and network shares.
Once domain-level access was achieved, the ransomware itself was frequently staged in the C:\PerfLogs\ directory, a location often overlooked by security monitoring tools, before enterprise-wide encryption was triggered. Researchers say this staging detail, along with a consistent registry-based persistence method, points to a shared operational playbook even as final-stage behavior varied.
Ransomware Operators Show Divergent Playbooks After Breach
While every intrusion analyzed began the same way, Arctic Wolf found that what happened next depended heavily on the individual affiliate carrying out the attack. Qilin operates under a ransomware-as-a-service model, meaning independent affiliates license the ransomware and infrastructure while running their own attacks, which helps explain the inconsistency in post-compromise behavior.
Fast Strikes Versus Extended Campaigns
Some affiliates moved to encrypt systems within hours of gaining access, apparently prioritizing speed over stealth and skipping data theft altogether. Others took a slower, more methodical approach: conducting extended reconnaissance, deploying additional remote access tools, quietly exfiltrating sensitive data, and only then triggering encryption as part of a double-extortion scheme designed to pressure victims on two fronts, both locked systems and the threat of leaked data.
Covering Their Tracks
Across multiple incidents, attackers took deliberate steps to frustrate recovery efforts. Investigators observed Windows event logs being cleared, Microsoft Defender disabled in some environments, and Veeam backup infrastructure specifically targeted, a tactic aimed squarely at eliminating an organization’s ability to restore data without paying a ransom.
Who Qilin Is and Why This Matters Beyond One Vendor
Qilin has been active since 2022 and has built a reputation as one of the more prolific ransomware-as-a-service operations currently running, with researchers linking the group to more than 500 claimed victims in 2026 alone. The group maintains a dark web leak site where it publishes stolen data from victims who decline to pay, a pressure tactic that has become standard across major ransomware operations.
A Familiar Pattern for Enterprise Security Teams
Security professionals note that this campaign fits a broader trend seen throughout 2025 and into 2026: ransomware groups increasingly prioritize edge devices, VPN gateways, and other internet-facing infrastructure as their initial foothold, rather than relying solely on phishing emails. These devices sit at the network perimeter by design, which means a single unpatched flaw can offer a direct path to an organization’s most sensitive internal systems.
What Organizations Should Do Right Now
Cybersecurity researchers and federal officials are urging immediate action for any organization running affected GlobalProtect deployments. Recommended steps include the following.
| Priority Action | Purpose |
|---|---|
| Apply the May 13 PAN-OS patch across all affected versions | Closes the authentication bypass |
| Terminate active GlobalProtect VPN sessions after patching | Removes any sessions established before the fix |
| Disable authentication override cookies or move to dedicated certificates | Interim mitigation if patching is delayed |
| Review VPN logs for anomalous or unexpected sessions | Identifies potential prior compromise |
| Monitor C:\PerfLogs\ for unexpected executable files | Detects a known ransomware staging technique |
| Rotate privileged credentials if compromise is suspected | Limits damage from stolen credentials |
| Forward logs to a centralized SIEM | Preserves forensic evidence against log clearing |
Affected releases reportedly span several PAN-OS branches, including versions in the 10.2, 11.1, 11.2, and 12.1 lines, along with certain Prisma Access configurations. Organizations unsure whether their deployment is affected should consult Palo Alto Networks’ security advisory directly and confirm patch status rather than assuming exposure based on version number alone.
The Bigger Picture
This campaign is a reminder that patching alone is not always enough once a vulnerability has been exploited in the wild. Security teams are advised to treat any GlobalProtect environment that was exposed before May 13, even briefly, as a potential compromise until proven otherwise, particularly given how quickly attackers in this campaign moved from initial access to full domain control.
As investigations continue, further updates on affected organizations, additional indicators of compromise, and potential new variants of this ransomware activity are expected in the coming days.
