Qilin RaaS Affiliates Weaponize PAN-OS GlobalProtect Auth-Bypass (CVE-2026-0257) for Credential-Free VPN Entry Leading to Full Domain Compromise

Arctic Wolf documented multiple June 2026 intrusions in which Qilin ransomware affiliates exploited CVE-2026-0257 — an authentication bypass in PAN-OS GlobalProtect triggered by misconfigured override cookies — to establish legitimate-looking VPN sessions without credentials, followed by LSASS dumping, NTDS.dit extraction, PsExec-based lateral movement, and enterprise-wide encryption. Palo Alto Networks patched on May 13, Rapid7 confirmed broad exploitation by May 17, and CISA ordered federal agencies to patch within three days on May 29; however, unpatched internet-facing deployments across PAN-OS 10.2–12.1 and Prisma Access remain actively targeted. The attack surface is significant given Palo Alto's footprint across 70,000+ customers including 90% of Fortune 10 companies.

The attack surface is significant given Palo Alto's footprint across 70,000+ customers including 90% of Fortune 10 companies.

This intelligence brief has been compiled from open-source reporting and corroborated across multiple threat intelligence sources. Defenders should treat the critical severity rating as a guide to prioritization within their environment.

For the latest indicators of compromise, formatted SIEM queries, and unredacted actor intelligence related to this brief, DMZ Operator subscribers receive automated IOC packages via email the moment new advisories are published.