Qilin RaaS Affiliates Weaponizing CVE-2026-0257 PAN-OS GlobalProtect Auth Bypass for Domain-Wide Encryption

Arctic Wolf Labs confirmed that Qilin ransomware affiliates are actively exploiting CVE-2026-0257, an authentication bypass in PAN-OS GlobalProtect (CVSS 7.8), to establish unauthorized VPN sessions and pivot to domain-wide encryption — a chain Arctic Wolf assesses as likely ongoing. Post-exploitation tradecraft varies across intrusions, ranging from rapid encryption-only operations to full double-extortion via Rclone/MEGA, consistent with multiple affiliates sharing a common exploit. Shadowserver tracks over 167,000 GlobalProtect instances exposed online, and the CISA KEV deadline for federal remediation has already passed.

Shadowserver tracks over 167,000 GlobalProtect instances exposed online, and the CISA KEV deadline for federal remediation has already passed.

This intelligence brief has been compiled from open-source reporting and corroborated across multiple threat intelligence sources. Defenders should treat the critical severity rating as a guide to prioritization within their environment.

For the latest indicators of compromise, formatted SIEM queries, and unredacted actor intelligence related to this brief, DMZ Operator subscribers receive automated IOC packages via email the moment new advisories are published.