Summary
- CVE-2026-0257 allows unauthorised VPN sessions in vulnerable GlobalProtect configurations.
- Rapid7 observed exploitation from 17 May, while later investigations linked several June intrusions to Qilin ransomware.
- Activity ranged from rapid encryption to longer operations involving reconnaissance, credential theft, and data exfiltration.
A vulnerability in Palo Alto Networks GlobalProtect has become an initial-access route for ransomware operations, with incident investigations linking exploited firewalls to credential theft, data exfiltration, and domain-wide encryption.
CVE-2026-0257 is an authentication bypass affecting GlobalProtect portals and gateways in certain PAN-OS and Prisma Access configurations. Successful exploitation allows an unauthenticated attacker to establish an unauthorised virtual private network session and enter the internal environment through an approved remote-access service.
The flaw is not exposed in every deployment. Palo Alto Networks says affected systems must use authentication-override cookies alongside a particular certificate configuration. Panorama and Cloud NGFW are not affected.
The vendor’s security advisory assigns the vulnerability a CVSS 4.0 score of 7.8, the highest suggested remediation urgency, and an exploitation status of “attacked”. Palo Alto Networks has confirmed limited attempts against unpatched devices that lacked mitigations.
Rapid7 detected the earliest observed activity on 17 May and found successful exploitation across several managed-detection customers. Its investigators identified forged authentication cookies and, in some cases, the assignment of a VPN address that gave the attacker internal network access.
Subsequent investigations by Arctic Wolf documented a more damaging progression. Several June intrusions began with exploitation of CVE-2026-0257 and ended with Qilin ransomware. Some moved rapidly to encryption, while others included reconnaissance, credential extraction, remote-access tools, lateral movement, data theft, and double extortion.
The variation may reflect different affiliates using a shared ransomware platform, exploit, or access method. A connection to Qilin in several incidents does not establish that every attempt against GlobalProtect belongs to the same operator.
A trusted session accelerates access
Once a gateway accepts the forged session, internal controls may treat the connection as an authenticated user arriving through an approved channel. Broad VPN permissions, limited segmentation, reusable administrative credentials, and heavy reliance on the firewall’s authentication decision can then shorten the route to wider compromise.
Investigators observed attackers extracting credentials, using compromised administrative accounts, moving through Windows administrative shares, and deploying ransomware across victim environments. Some incidents also included transfers to cloud-storage services before encryption began.
Patching closes the vulnerable path but does not establish whether it was previously used. Organisations with exposed configurations should review authentication logs, unusual cookie-based sessions, unfamiliar source infrastructure, unexpected VPN address allocation, local administrator use, credential access, newly installed remote-management tools, and lateral execution.
An environment without encryption or a ransom demand may still have experienced access. An attacker can perform reconnaissance, collect credentials, exfiltrate information, or transfer access to another operator without immediately disrupting systems.
The incident reinforces the need for maintenance standards specific to edge appliances. VPN gateways and firewalls are reachable by design, hold a privileged network position, and can provide direct access to services that are otherwise unavailable from the internet. Public exploit information can reduce patching windows to days or hours.
Configuration management is equally relevant. Authentication override is not enabled by default, although older settings may remain in place to reduce user friction. Features retained long after their original operational purpose can become the condition that makes a later vulnerability exploitable.
Palo Alto Networks has released fixed versions and recommends disabling authentication override, or using a certificate dedicated to that function, where patching cannot be completed immediately. Those measures address current exposure but cannot replace investigation of earlier sessions.
Once an unauthorised VPN connection has been accepted, the event belongs in an identity and enterprise-compromise investigation rather than a firewall patching queue alone.
