Qilin and Inc exploit PAN-OS GlobalProtect bypass CVE-2026-0257
Unit 42 says operators bypass MFA for VPN access, then move via RDP and SMB toward ransomware.
88
CVE-2026-0257
Authentication Bypass in Palo Alto Networks PAN-OS GlobalProtect Portal and Gateway
CISA: Palo Alto Networks PAN-OS Authentication Bypass Vulnerability
- CVSS 4.0
- 7.8 high
- EPSS
- 95%p100
- Published
- ·
- Added to KEV
AI analysisSummaries by Vani AI
CVE-2026-0257 is an authentication bypass in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS that allows a remote, unauthenticated attacker to defeat security restrictions and establish an unauthorized VPN connection; incident reporting indicates it involves forged VPN cookies (CWE-565). An attacker who succeeds gains the network access of a legitimate remote-access user, and Qilin ransomware affiliates have been using this flaw as their initial access vector. Any organization running PAN-OS with the GlobalProtect portal or gateway enabled is in scope, including Siemens RUGGEDCOM APE1808 appliances that run PAN-OS, while Panorama and Cloud NGFW are explicitly not affected. Exploitation is confirmed in the wild: the flaw was added to CISA KEV on 2026-05-29 with ransomware use known, EPSS assigns it a 93.9% probability of exploitation within 30 days (100th percentile), and Rapid7 has documented attacks against multiple customers.
What to do: Upgrade PAN-OS to the fixed release specified in the Palo Alto Networks security advisory, and check Siemens' guidance if you operate RUGGEDCOM APE1808 appliances. Review GlobalProtect portal/gateway logs for forged VPN cookies and unauthorized VPN sessions, and hunt for Qilin ransomware indicators on hosts reachable through the VPN. If patching cannot happen immediately, restrict internet exposure of the GlobalProtect portal and gateway; federal agencies must apply mitigations per BOD 22-01 given the KEV listing.
| Product | Affected |
|---|---|
| Palo Alto Networks PAN-OS (GlobalProtect portal and gateway) | — |
| Palo Alto Networks Prisma Access | Listed in CPE data; affected status not detailed in source description, confirm with vendor advisory |
| Siemens RUGGEDCOM APE1808 firmware | — |
Estimated exposure
massOn the order of hundreds of thousands of internet-exposed GlobalProtect portals/devices (mid-six figures) — PAN-OS is one of the most widely deployed enterprise firewall/VPN platforms and public internet scans have historically shown hundreds of thousands of exposed GlobalProtect portals, so exposure is plausibly in the hundreds of thousands of…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Authentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS® software allows the attacker to bypass security restrictions and establish an unauthorized VPN connection. Panorama and Cloud NGFW are not impacted by these issues.
KEVCISA Known Exploited Vulnerability
- Affected
- Palo Alto Networks PAN-OS
- Required action
- Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Due date
- Ransomware use
- Known
- Vendors
- paloaltonetworkssiemens
- Products
- pan-os, prisma access, ruggedcom ape1808 firmware
- Weakness
- CWE-565
- Vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:N/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:A/V:D/RE:M/U:Red
In the news
20 storiesRansomware Hackers Exploit Palo Alto Networks GlobalProtect VPN Authentication Bypass Vulnerability
Qilin and Settra ransomware gangs actively exploit Palo Alto GlobalProtect auth bypass CVE-2026-0257 to hijack VPN sessions and breach networks.
88
October 21 fixes cover PHP2Shell, LiteLLM theft, and VPN attacks
Fixed PHP builds are 8.5.12, 8.4.27, 8.3.36, and 8.2.35; LiteLLM 1.107.0 stole secrets, so pin 1.106.2 and rotate them.
86
ThreatsDay: Adobe RCE, DNS Wallet Theft, NVIDIA Container Escape, Self-Healing Backdoor + 23 More
Qilin and Settra are exploiting PAN-OS GlobalProtect flaw CVE-2026-0257, alongside new RATs and a DNS wallet drainer.
86
Ransomware groups exploit Palo Alto GlobalProtect flaw CVE-2026-0257
Unit 42 has investigated intrusions since early June; Qilin, Inc, and Settra are among the operators named.
84
Ransomware groups exploit Palo Alto PAN-OS bug CVE-2026-0257
Unit 42 says Qilin, Inc and others use the GlobalProtect flaw for unauthorized VPN access, then ransomware, across many industries.
84
Ransomware groups exploit GlobalProtect MFA bypass CVE-2026-0257
Unit 42 says attackers forged authentication-override cookies, then pulled domain credentials from a VMware virtual disk offline.
84
Operation Master Exploits GlobalProtect CVE-2026-0257 and Deploys AdaptixC2 Across Enterprise Networks
Operation Master exploited GlobalProtect CVE-2026-0257, deployed AdaptixC2, and ran large-scale credential theft and invoice fraud.
84
Ransomware Actors Exploiting Palo Alto GlobalProtect Flaw for Stealthy VPN Access
Qilin and Settra are exploiting Palo Alto GlobalProtect CVE-2026-0257 for unauthorized VPN access.
83
Qilin and INC exploit patched PAN-OS flaw to bypass MFA
Unit 42 says CVE-2026-0257 yields unauthorized VPN sessions, followed by RDP, SMB, and ransomware staging.
82
Ransomware groups exploit PAN-OS flaw CVE-2026-0257 to bypass MFA
Unit 42 says the GlobalProtect cookie bug yielded VPN access and later ransomware across several sectors since early June 2026.
82
CyberXero Uses Claude Code in Campaign That Stole Over 628,000 Ukrainian Records
Russian-speaking broker 'CyberXero' used Claude Code agents and Cobalt Strike to steal 628,000+ Ukrainian records via WordPress and critical infrastructure attacks.
80
k0t exploits edge firewalls and VPNs, exposing over 70,000 credentials
Group-IB and NyxLab say k0t used FortiWeb and PAN-OS flaws, then remote-access tools and cloud exfiltration, from February to June 2026.
78
k0t steals credentials from FortiGate, FortiWeb and GlobalProtect
Group-IB reports more than 70,000 exposed credentials and active use of CVE-2025-64446 and CVE-2026-0257.
78
Operators hit FortiGate, FortiWeb and GlobalProtect to steal stored passwords
Group-IB and NyxLab tie the edge-device campaign to k0t and report more than 70,000 exposed credentials.
78
Qilin and INC exploit patched Palo Alto VPN bypass (CVE-2026-0257)
Unit 42 says the groups still use the May 2026 PAN-OS and Prisma Access fix to open unauthorized VPNs.
78
Months-Old Palo Alto VPN Vulnerability Remains a Target for Ransomware Groups
Qilin and Settra are still exploiting Palo Alto CVE-2026-0257 to open unauthorized VPN sessions.
78
Hackers Exploit GlobalProtect Flaw and Turn Stolen Data Into 2.4 Million Fraud Messages
Criminals exploited a GlobalProtect bypass, stole customer records, and sent 2.4 million fake bills.
78
July 2026 CVE Landscape
60
60