Critical PAN-OS Vulnerability Exploited by Qilin Ransomware Gang

Key Takeaways

• A critical authentication bypass vulnerability, CVE-2026-0257, in Palo Alto Networks PAN-OS GlobalProtect has been actively exploited.
• The Qilin ransomware gang is leveraging this flaw to gain unauthorized access to corporate networks.
• The vulnerability carries a CVSS score of 7.8 and affects specific versions of PAN-OS and Prisma Access.
• Palo Alto Networks has released patches, and immediate application is crucial to mitigate ongoing threats.

Cybersecurity researchers at Arctic Wolf Labs have uncovered active exploitation of a severe authentication bypass vulnerability within Palo Alto Networks firewalls. Threat actors, specifically linked to the Qilin ransomware operation, are leveraging this flaw to infiltrate enterprise networks and deploy their malicious payloads.

Arctic Wolf’s investigation, spanning multiple incidents throughout June 2026, consistently identified this vulnerability as the initial vector for compromise.

The flaw, identified as CVE-2026-0257 with a CVSS score of 7.8, impacts the GlobalProtect portal and gateway components of PAN-OS. It becomes exploitable under specific conditions: when authentication override cookies are enabled in conjunction with particular certificate configurations. This setup allows unauthenticated attackers to completely circumvent login mechanisms, establishing what appear to be legitimate VPN sessions into target environments.

Versions of PAN-OS affected include 12.1, 11.2, 11.1, and 10.2 (specifically those prior to their respective patched builds), alongside certain releases of Prisma Access. Palo Alto Networks has acknowledged limited active exploitation of this vulnerability in the wild.

In the intrusions analyzed by Arctic Wolf, attackers exploited these compromised VPN sessions to achieve direct, interactive access to victim networks, bypassing all perimeter authentication measures.

PAN-OS Vulnerability Exploited

Once inside the network, the attackers demonstrated a rapid and systematic approach:

• Persistence was established through the creation of registry Run keys, distinguished by a naming convention of an asterisk followed by six random lowercase letters.
• Remote access tools such as AnyDesk, Ngrok, and LogMeIn were deployed to ensure redundant connectivity.
• Credentials were dumped from LSASS memory using a combination of rundll32.exe and comsvcs.dll, with the output disguised as a “.odt” file to evade detection.
• The entire Active Directory database was extracted via ntdsutil.exe, providing domain-wide credential access.
• PsExec and administrative shares (C$) were utilized for lateral movement across the compromised network.

Intriguingly, several observed attacks originated from systems that self-identified with the hostname “kali.” Furthermore, overlapping IP addresses were noted between the initial exploitation phase and subsequent VPN sessions, suggesting the use of shared infrastructure or tooling among Qilin affiliates.

While the initial point of entry and core exploitation techniques remained consistent, the post-exploitation activities varied considerably. Some intrusions progressed directly to encryption with minimal dwell time, while others involved extensive reconnaissance, large-scale credential harvesting, and data exfiltration using Rclone to MEGA cloud storage before the ransomware was deployed.

This variability is characteristic of ransomware-as-a-service (RaaS) operations, where different affiliates may employ shared tools but implement their own distinct attack strategies.

Prior to initiating encryption, the attackers routinely disabled Microsoft Defender’s real-time protection and systematically cleared Windows Event Logs. They used a PowerShell script designed to clear every log channel on the system, not just security or system logs, significantly hindering forensic recovery efforts.

The ransomware payload itself, consistently named win.exe, was staged in C:PerfLogs, a default Windows directory often overlooked by security tools. Its execution required a specific password parameter, complicating sandbox analysis.

What You Should Do

Arctic Wolf assesses with moderate confidence that ongoing exploitation of this vulnerability is occurring, fueled by widespread scanning activity and the RaaS model’s distribution of effective exploits among numerous affiliates. Immediate action is critical:

• Apply patches for CVE-2026-0257 across all internet-facing PAN-OS and Prisma Access deployments without delay.
• Terminate all active GlobalProtect sessions immediately after patching.
• Rotate all domain credentials, including the KRBTGT account, if there is any suspicion of exploitation.
• Implement monitoring and restrict execution from the C:PerfLogs directory.
• Ensure Windows Event Logs are forwarded to a centralized SIEM system to preserve evidence, even if local logs are cleared.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.