PAN-OS VPN Flaw CVE-2026-0257 Exploited in Qilin Ransomware Attacks

Introduction

A high-severity PAN-OS VPN flaw, tracked as CVE-2026-0257, is being actively exploited in intrusions that have resulted in Qilin ransomware deployment. The vulnerability affects GlobalProtect portal and gateway configurations on certain PAN-OS versions, as well as affected Prisma Access 10.2 and 11.2 releases, and can allow an attacker to establish an unauthorized VPN connection.

Palo Alto Networks published the advisory and remediation guidance in May 2026. The current advisory confirms limited exploit attempts against unpatched PAN-OS devices without the recommended mitigations. Incident response investigations later linked the vulnerability to multiple ransomware intrusions during June 2026. These incidents show how internet-facing VPN infrastructure can become an effective initial access point for attackers.

Therefore, organizations should view this incident as more than a patch management issue. Even after applying updates, security teams should validate mitigations, review VPN authentication logs, and investigate managed endpoints to determine whether attackers established persistence before remediation.

At a Glance

What is CVE-2026-0257?

CVE-2026-0257 is an authentication bypass vulnerability affecting GlobalProtect portal and gateway configurations on certain PAN-OS versions. It also affects Prisma Access 10.2 and 11.2 releases. Under specific configurations involving authentication override cookies, an unauthenticated attacker may establish an unauthorized VPN connection.

Palo Alto Networks disclosed the vulnerability on May 13, 2026, and published remediation guidance identifying fixed PAN-OS and Prisma Access releases. The current advisory confirms limited exploit attempts against unpatched PAN-OS devices without the recommended mitigations. As a result, CISA added the vulnerability to its Known Exploited Vulnerabilities Catalog on May 27, 2026, reinforcing the need for prompt remediation.

Panorama itself and Cloud NGFW are not affected; however, PAN-OS firewalls managed through Panorama may still require assessment and remediation.

How the PAN-OS VPN Flaw Works

CVE-2026-0257 is an authentication bypass vulnerability affecting GlobalProtect portal and gateway configurations on certain PAN-OS versions, as well as affected Prisma Access 10.2 and 11.2 releases. When Authentication Override cookies are enabled under the affected certificate configuration, an unauthenticated attacker may bypass authentication and establish an unauthorized VPN connection.

Public investigations indicate that attackers used CVE-2026-0257 as the initial access vector in multiple enterprise intrusions that later culminated in Qilin ransomware deployment. After obtaining VPN access, attackers conducted additional post-compromise activity before deploying ransomware. Investigations observed varying tradecraft, including rapid encryption-focused operations and incidents that exhibited characteristics consistent with double-extortion campaigns.

Arctic Wolf also reported credential harvesting, LSASS dumping, NTDS extraction, PsExec-based lateral execution, and data exfiltration in some investigated incidents. However, other attacks progressed directly to ransomware deployment without confirmed data exfiltration.

PAN-OS VPN Flaw Attack Timeline

Why the PAN-OS VPN Flaw Matters to Enterprises

Internet-facing remote-access infrastructure can provide attackers with a path into enterprise networks when a vulnerability enables unauthorized VPN access.

The investigated intrusions demonstrate that exploitation of CVE-2026-0257 can enable credential access, lateral movement, data exfiltration, and ransomware deployment in some environments. Because the vulnerability affects internet-facing GlobalProtect deployments, organizations should treat it as more than a routine software update.

After remediation, organizations should review historical VPN, identity, and endpoint activity for evidence that attackers established access before security updates were applied.

This incident also reinforces the value of combining vulnerability management with endpoint investigation and identity controls to help identify and contain potential follow-on activity after exploitation.

How to Respond to CVE-2026-0257

Organizations using affected Palo Alto Networks GlobalProtect deployments should prioritize remediation and conduct follow-up investigations where exposure cannot be ruled out. Applying vendor updates is the first step, but organizations that remained unpatched during active exploitation should assume additional validation is necessary.

Security teams should:

• Upgrade affected PAN-OS deployments to the fixed versions listed in Palo Alto Networks’ advisory. If you use Prisma Access, confirm that Palo Alto Networks has completed the scheduled upgrade for your environment. For affected PAN-OS firewalls that cannot be upgraded immediately, use a dedicated certificate exclusively for Authentication Override cookies or disable Authentication Override, as documented by Palo Alto Networks.
• Verify the PAN-OS version. Then determine whether GlobalProtect portals or gateways generate or accept authentication-override cookies under the affected certificate configuration. Confirm that affected components have been upgraded or that the documented mitigations are applied.
• Review VPN authentication logs for unusual or unexpected access during the exposure period.
• Inspect privileged and identity accounts for suspicious authentication activity or unauthorized administrative changes.
• Investigate managed endpoints and servers within potentially affected network segments for evidence of persistence, credential access, lateral movement, remote-access tooling, or ransomware staging.
• Validate backup and recovery procedures and ensure incident response plans are ready if malicious activity is discovered.

A coordinated response combining vulnerability remediation with endpoint and identity investigations can help identify evidence of access that may have persisted after patching.

Featured resource

Hexnode UEM Capability Statement

Explore how Hexnode UEM helps organizations enforce compliance, manage updates, and strengthen endpoint security across the device lifecycle.

Download the brochure

How Hexnode Can Help

While the initial exploitation targets affected GlobalProtect infrastructure, endpoint visibility becomes important if attackers move beyond the remote-access environment.

Hexnode XDR can help security teams use Advanced Investigation Queries to examine up to seven days of detailed historical endpoint data. During an investigation, analysts can isolate an endpoint while preserving its connection to Hexnode XDR. They can also use Kill Process to terminate a selected process or Kill Process Tree to terminate that process and its spawned child processes.

Subject to platform, enrollment, and feature support, Hexnode UEM can enforce device compliance policies. It can also manage operating system and application updates, apply supported security configurations, and perform remote device-management actions during remediation.

For supported Android, iOS, and macOS 11 or later devices, Hexnode UEM can provide device compliance data through its Microsoft Entra Conditional Access integration. The identity provider can then enforce conditional-access requirements, including MFA and compliant-device access rules.

These controls do not remediate CVE-2026-0257, but Microsoft Entra Conditional Access can use compliance data supplied by Hexnode for supported Android, iOS, and macOS devices to restrict access based on device compliance.

Key Takeaways

• CVE-2026-0257 is an authentication bypass vulnerability affecting Palo Alto Networks GlobalProtect.
• Public investigations have linked exploitation of the vulnerability to intrusions that resulted in Qilin ransomware deployment.
• Organizations should treat the flaw as both a vulnerability management and incident response priority.
• Remediation should be followed by VPN log reviews, identity validation, and endpoint investigations to identify possible post-compromise activity.
• Combining timely remediation with endpoint investigation and identity controls can support efforts to detect and contain follow-on activity after exploitation of internet-facing VPN infrastructure.

Conclusion

The exploitation of CVE-2026-0257 shows how quickly vulnerabilities affecting remote-access infrastructure can become enterprise security incidents. Prompt remediation, continuous monitoring, and thorough post-compromise investigations remain essential to limiting the impact of attacks that target internet-facing VPN infrastructure.