The record
Written from the 2 reports below. Nothing here is unsourced.
- The Qilin ransomware-as-a-service group is actively exploiting CVE-2026-0257, a critical authentication bypass vulnerability in Palo Alto Networks PAN-OS affecting GlobalProtect VPN portals.
- The flaw carries a CVSS score of 7.8 and has ben listed in CISA's Known Exploited Vulnerabilities catalog, confirming in-the-wild abuse.
- Atackers are using the bypass to gain initial acss to corporate networks before deploying ransomware payloads.
- Palo Alto Networks has released patches, but exploitation is outpacing remediation acording to threat intel reports from The Hacker News and BleepingComputer.
- Organizations with exposed GlobalProtect instances face immediate risk of network compromise, data exfiltration, and operational disruption.
- Post-exploitation activity includes disabling Microsoft Defender and clearing logs to evade detection.
- The situation underscores the criticality of timely patching for perimeter and VPN infrastructure.
What to watch next
- Wathe for CISA advisories and vendor patch enforcement deadlines
- Monitor for indicators of Qilin ransomware activity across VPN logs
- Cofirm all GlobalProtect portals are patched to latest PAN-OS version
What changed2
Every report on this story, newest first. Times are when each outlet published.
The Hacker News[1]
Qilin Ransomware Attackers Exploit PAN-OS Authentication Bypass for Initial AccessBleepingComputer[2]
Critical Palo Alto VPN bug now exploited by Qilin ransomware gang
Why it matters4
Who is affected first and what likely follows, with a direction and a horizon. Extracted from the reports, never invented.
- Organizations using Palo Alto Networks GlobalProtect VPN network breach via authentication bypass· immediate
- Organizations using Palo Alto Networks GlobalProtect VPN ransomware deployment· days
- Security operations teams log tampering and defender evasion· days
- Compliance/GRC functions patch remediation urgency· immediate
Coverage2
2 reports
English national1International1
Filed from India ×1, United States ×1
Named India · Asahi · Court Services Victoria · GlobalProtect · Lee Enterprises · Microsoft · Microsoft Defender · Nissan · Palo Alto Networks · PAN-OS · Synnovis · Yangfeng · Agenda
The 2 reports are listed beside the record.
Ask this story
Answers cite the reports above, or say they can't.