iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
CVE-2026-0257 remains a serious concern for organizations running affected GlobalProtect configurations: exploitation was observed within days of disclosure, and Arctic Wolf Labs later documented June 2026 intrusions in which attackers used the flaw to gain initial access before deploying Qilin ransomware. Those incidents establish a link in the cases Arctic Wolf investigated—not that every attempt to exploit the vulnerability involved Qilin.
What CVE-2026-0257 does—and which deployments may be exposed
Palo Alto Networks published its security advisory on May 13, 2026. The vulnerability is an authentication bypass affecting the GlobalProtect portal and gateway in certain PAN-OS and Prisma Access configurations. Under the conditions described by the vendor, an unauthenticated remote attacker may bypass security restrictions and establish a VPN connection.
Exposure depends on configuration as well as software version. The vendor identifies authentication override cookies and a particular certificate arrangement as relevant conditions. It lists affected and fixed releases across PAN-OS 10.2, 11.1, 11.2 and 12.1, and Prisma Access 10.2 and 11.2. Check the current Palo Alto Networks advisory against the exact product, release and configuration in your environment; a fixed release for one branch should not be assumed to apply to another. The advisory says Panorama and Cloud NGFW are not affected.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Why the vulnerability remains consequential months later
Exploitation was seen soon after disclosure
Rapid7 reported its earliest observed exploitation on May 17, four days after the vendor’s advisory, and described successful exploitation across numerous managed detection and response (MDR) customers. Palo Alto Networks’ advisory says it became aware of limited exploit attempts on unpatched PAN-OS devices without mitigations applied.
#1 Best Overall
Rapid7’s findings distinguish an accepted probe from a completed VPN connection. In eight of its ten impacted MDR customers, Rapid7 observed a successful exploitation probe but no full VPN session. That figure describes Rapid7’s investigated customer sample; it is not an estimate of the share of vulnerable GlobalProtect appliances that were exploited or the share of attempts that succeed.
The severity assessment rose as threat information developed
Palo Alto Networks’ advisory currently lists CVE-2026-0257 as High, with a severity score of 7.8, and marks its exploitation status as Attacked. Rapid7 recorded the score changing from 4.7 Medium to 7.8 High as information about the threat developed. The earlier score is part of the chronology, not the current advisory rating.
Rank #2
The flaw entered CISA’s Known Exploited Vulnerabilities catalog
Palo Alto Networks Unit 42 reported active exploitation attempts and said the vulnerability was added to the U.S. Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalog on May 29, 2026. In the activity described in Unit 42’s June 9 update, only a small portion of probed devices established VPN sessions, and Unit 42 had not identified post-access behavior or lateral movement at that time. That statement applies to the activity covered by that update; it does not rule out follow-on activity in other incidents.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Arctic Wolf linked investigated June intrusions to Qilin ransomware
Arctic Wolf Labs reported multiple intrusions during June 2026 in which exploitation of CVE-2026-0257 was the initial access vector and Qilin ransomware was deployed. Its cases varied: some involved rapid encryption, while others included data exfiltration and double extortion. Arctic Wolf said the variation could suggest that multiple affiliates were operating under the Qilin ransomware-as-a-service umbrella. This is a finding about the intrusions Arctic Wolf investigated, not proof that Qilin or one specific actor was behind every attempt to exploit the flaw.
How to check and reduce exposure
- Identify the exact deployment. Inventory the PAN-OS or Prisma Access product, release and GlobalProtect portals and gateways in use. Compare each release with the affected and fixed-version tables in Palo Alto Networks’ current CVE-2026-0257 advisory.
- Verify the configuration conditions. Determine whether authentication override cookies are enabled and whether the certificate arrangement described in the advisory is present. A version check alone does not establish whether the relevant configuration is in place.
- Choose the vendor’s version-specific remediation. Upgrade to the fixed release for the exact software branch, following the advisory’s instructions. If using authentication override cookies, Palo Alto Networks says all portals and gateways that generate or accept them should be upgraded according to its product-status table to avoid cookie compatibility problems.
- Apply a stated mitigation if an upgrade is not immediately feasible. The advisory lists two options: use a dedicated certificate exclusively for authentication override cookies, or disable authentication override. Confirm the appropriate change for the deployment in the live advisory rather than substituting a release or configuration setting from another branch.
- Review logs and escalate suspicious successful sessions. Use Unit 42’s listed indicators to hunt in GlobalProtect logs. Unit 42 recommends activating incident-response protocols for successful gateway-connected events associated with those indicators. Treat an unsuccessful probe differently from evidence of an established VPN session, while investigating both in context.
What the evidence does—and does not—show
- Established: Palo Alto Networks disclosed the flaw on May 13, 2026; exploitation was observed shortly afterward; and Arctic Wolf documented investigated June intrusions that used it for initial access before Qilin ransomware deployment.
- Not established: The available reports do not provide a population-wide exploitation rate for exposed GlobalProtect appliances, show that every successful attempt led to a VPN session, or demonstrate that every exploitation attempt involved ransomware.
- Operational distinction: A probe or attempted authentication is not the same as a successful gateway-connected session. Rapid7’s sample and Unit 42’s activity-specific update illustrate why incident decisions should be based on the evidence in an organization’s own logs, not on a generalized rate.
Organizations that suspect compromise can follow Unit 42’s incident-response guidance and contact its incident response team. Palo Alto Networks’ advisory remains the source for current fixed releases, mitigations and compatibility guidance.
Quick Recap
Rank #4
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
