Qilin exploits CVE-2026-0257 in PAN-OS GlobalProtect to breach VPNs

The Qilin ransomware operation is abusing CVE-2026-0257, an authentication bypass vulnerability in PAN-OS GlobalProtect, to gain unauthorized access to corporate networks. The flaw affects GlobalProtect portals and gateways and especially impacts unpatched systems, which remain exposed even when the perimeter appears well protected. Palo Alto Networks fixed the issue in May, but attackers have shown that VPN systems remain a privileged entry point for lateral movement and data encryption. The fact that a ransomware group is exploiting an authentication flaw at the network edge greatly increases the urgency of patching. The case is a reminder that remote access appliances are not just network devices, but real corporate identity control points.

Source: Security Affairs