// NEXUSVOID CYBER NEWS
<- ALL CYBER NEWS
Critical
PAN-OS, Palo Alto Networks, Qilin ransomware, VPN, CVE-2026-0257, KEV, initial access
Qilin Ransomware Exploits PAN-OS CVE-2026-0257
Qilin ransomware is exploiting Palo Alto PAN-OS GlobalProtect auth bypass CVE-2026-0257 (EPSS 99.7th percentile, in CISA KEV) for initial access. Patch and audit now.
Published July 21, 2026.
Qilin ransomware affiliates are exploiting PAN-OS CVE-2026-0257, an authentication bypass in Palo Alto Networks' GlobalProtect portal and gateway, to break into networks without valid credentials. The flaw sits in CISA's Known Exploited Vulnerabilities catalog with an EPSS score in the 99.7th percentile — patch and audit GlobalProtect exposure now.
What happened. Arctic Wolf Labs tied multiple June 2026 intrusions to exploitation of CVE-2026-0257, an authentication bypass affecting the portal and gateway components of Palo Alto Networks PAN-OS software. When authentication-override cookies are enabled with specific certificate configurations, an unauthenticated remote attacker can sidestep authentication and establish a VPN session with no valid credentials. After gaining access, the operators staged ransomware at C:\PerfLogs\, used PsExec for lateral movement over administrative shares, deployed password-protected payloads, and ran log-clearing routines — behavior consistent with multiple affiliates operating under the Qilin (aka Agenda) ransomware-as-a-service umbrella.
What is PAN-OS CVE-2026-0257?
CVE-2026-0257 is an authentication bypass in the GlobalProtect portal and gateway of PAN-OS. It carries a CVSS 4.0 score of 7.8 (High) and is listed in CISA's Known Exploited Vulnerabilities catalog (added May 29, 2026, and flagged as known to be used in ransomware campaigns). Its EPSS score is 86.7% — the 99.7th percentile, meaning it is among the most likely vulnerabilities on the internet to be exploited. Palo Alto notes that Panorama and Cloud NGFW are not impacted.
Which products are affected?
Component | Status |
|---|---|
PAN-OS GlobalProtect portal | Affected — auth bypass |
PAN-OS GlobalProtect gateway | Affected — auth bypass |
Panorama | Not impacted |
Cloud NGFW | Not impacted |
What to do now.
Apply Palo Alto's PAN-OS fixes for CVE-2026-0257, or apply the vendor's mitigations if you cannot patch immediately (the CISA KEV remediation deadline has already passed).
Review the GlobalProtect configuration: disable authentication-override cookies where they are not required, and audit the certificate configurations that enable the bypass.
Hunt for post-exploitation artifacts: ransomware staging under
C:\PerfLogs\, unexpected PsExec use over admin shares, and cleared/missing event logs.Reset credentials and VPN session tokens on any device that was internet-exposed and unpatched.
Who's affected. Any organization running an internet-facing PAN-OS GlobalProtect portal or gateway with vulnerable configurations — Panorama and Cloud NGFW users are not affected by this issue.
Our read. This is a textbook case for continuous verification. CVE-2026-0257 is not a fresh zero-day — it has been in CISA's KEV catalog since May, with an EPSS score in the top 0.3% of all vulnerabilities — yet Qilin was still finding unpatched, internet-facing gateways in June. Per our analysis of 2025's exploited vulnerabilities, 67% of actively exploited flaws would be missed by an annual pentest; a known-exploited VPN bypass sitting open for weeks is exactly that gap. Knowing a patch exists is not the same as verifying every edge device is actually on it and configured safely.
Reporting by The Hacker News; intrusion detail per Arctic Wolf Labs. CVSS, EPSS and KEV status per NVD, FIRST.org and CISA. Sources linked above. Related: our continuous verification approach.