GlobalProtect VPN Flaw Linked to Qilin Ransomware: Patch, Then Check Sessions
Arctic Wolf says attackers exploited Palo Alto Networks GlobalProtect CVE-2026-0257 as an initial access route in multiple Qilin ransomware intrusions.
Quick takeaways
- Palo Alto Networks says CVE-2026-0257 can let an unauthenticated network attacker establish an unauthorised GlobalProtect VPN connection in specific authentication-override cookie configurations.
- Arctic Wolf says multiple June 2026 Qilin ransomware intrusions it investigated began with exploitation of this GlobalProtect flaw.
- Admin VPNs and access gateways reduce exposure only when patched and monitored; a consumer VPN app does not fix a vulnerable enterprise VPN appliance.
What happened?
Arctic Wolf Labs says it investigated multiple June 2026 intrusions where attackers exploited CVE-2026-0257 in Palo Alto Networks PAN-OS GlobalProtect as the initial access vector, then moved toward Qilin ransomware deployment. The company says post-exploitation activity varied, from rapid encryption to reconnaissance, credential harvesting, remote-access tooling and data exfiltration before ransomware.
Palo Alto Networks' advisory describes CVE-2026-0257 as authentication bypass vulnerabilities in the GlobalProtect portal and gateway. In affected configurations, an unauthenticated network attacker can bypass security restrictions and establish an unauthorised VPN connection. Palo Alto Networks lists the exploit maturity as attacked and the suggested urgency as highest.
Why it matters
VPN appliances are attractive targets because they are deliberately reachable from the internet and sit on the edge of trusted networks. If an attacker can create what looks like an authenticated VPN session, the compromise may resemble a legitimate remote-access login rather than a noisy web exploit.
BleepingComputer reports that CISA added the flaw to its Known Exploited Vulnerabilities catalog in May and later flagged it as used in ransomware attacks. The article also cites internet-exposure figures from Shadowserver and Shodan, while noting that those counts do not prove how many instances are still vulnerable or already patched.
What admins should do now
Check whether your PAN-OS or Prisma Access versions and GlobalProtect authentication-override cookie settings match Palo Alto Networks' exposure conditions. Apply the fixed releases or vendor mitigations for your exact branch, and plan for GlobalProtect users to re-authenticate where the fix regenerates cookies.
After patching, review GlobalProtect authentication logs for unusual sessions, locations, providers or device hostnames, and terminate active sessions according to vendor guidance. If you find suspicious access, assume the VPN bug may have been only the front door: investigate credential dumping, administrative-share movement, remote-access tools, log clearing and ransomware staging.
What ordinary readers should take from it
This story is about enterprise VPN infrastructure, not whether personal VPN apps are bad. A consumer VPN protects your device traffic on networks you do not control. A corporate VPN gateway grants remote access into an organisation. When that gateway is vulnerable, it can become a door attackers use against the organisation itself.
If you are an employee, follow your company's VPN update and re-authentication instructions quickly, report suspicious MFA or login prompts, and do not install unofficial remote-access tools. If you run a small business, inventory any internet-facing VPN, firewall and remote-admin portals before the next emergency patch lands.
Where a VPN helps — and where it does not
A correctly patched, tightly configured admin VPN can reduce exposure by limiting who can reach internal tools and management interfaces. That benefit depends on MFA, least privilege, logging, fast patching, session review and removing unnecessary public access.
A consumer VPN does not patch PAN-OS, invalidate stolen or forged sessions, stop Qilin, detect credential dumping or replace incident response. The VPN-relevant lesson is not 'use any VPN'; it is 'treat VPN gateways as critical security infrastructure, not set-and-forget plumbing.'
VPN Rocks view
This is a useful nuance for VPN buyers and small teams. VPNs are security tools, but they are also software and infrastructure that need maintenance. The same remote-access feature that helps employees work safely can become a high-value target if it falls behind on patches or logs are ignored.
For personal use, keep using a reputable VPN on risky networks if it fits your threat model. For business use, add the operational basics: patch SLAs for edge devices, MFA, no broad admin accounts, session monitoring, and a written plan for what to do when CISA or a vendor says a VPN flaw is being exploited.
Sources and further reading
VPN Rocks adds plain-English analysis and practical advice. Source links are included so readers can check the underlying guidance directly.