A high-severity authentication bypass vulnerability in Palo Alto Networks PAN-OS — CVE-2026-0257 — has been confirmed as an active initial access vector for Qilin ransomware affiliates. The flaw affects the GlobalProtect portal and gateway components, allowing remote unauthenticated attackers to forge valid session cookies and establish unauthorized VPN connections. Patches were released on May 13, 2026, but exploitation was observed as early as May 17, just four days after the fix dropped.
Arctic Wolf Labs documented multiple intrusions in June 2026 where CVE-2026-0257 provided the foothold. Post-exploitation activity varied across incidents — a pattern consistent with a ransomware-as-a-service (RaaS) model where multiple affiliates operate under the Qilin banner with different toolchains. CISA added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog on May 29, 2026, mandating federal remediation. The root cause is insufficient validation of authentication override cookies when the same certificate is used for both cookie encryption and the HTTPS service — a configuration common in default deployments.
Organizations that have not yet patched should treat this as an emergency. The attack surface is significant: any firewall running GlobalProtect with authentication override cookies enabled and a shared certificate configuration is exposed. Mitigations include applying the vendor patch, disabling authentication override features, or using dedicated certificates for cookie encryption separate from the portal/gateway HTTPS cert.
Sources
- Arctic Wolf Labs — Exploitation of CVE-2026-0257 Leads to Qilin Ransomware
- BleepingComputer — Critical GlobalProtect VPN Bug Now Exploited in Ransomware Attacks
- Rapid7 — Observed Exploitation of PAN-OS GlobalProtect Auth Bypass
Commentary
VPN appliances continue to be the preferred initial access vector for ransomware operators, and CVE-2026-0257 is a perfect illustration of why. The four-day gap between patch release and observed exploitation is not unusual in this threat landscape — well-resourced RaaS operators reverse-engineer vendor patches as a standard workflow and immediately feed working exploits to affiliates. GlobalProtect is deployed at scale in enterprise environments, which makes this CVE a high-value target regardless of CVSS score.
The cookie-forging mechanic here is particularly clean from an attacker’s perspective: no credentials, no phishing, no social engineering — just a forged TLS session that looks legitimate to the gateway. Organizations should audit their GlobalProtect certificate configurations even if they believe they’re patched, and review VPN session logs back to May 13 for anomalous authentication patterns. If you find evidence of exploitation, assume full network access was achieved and treat it as a full incident response engagement.