A Palo Alto VPN auth bypass is now a Qilin ransomware front door

A 7.8 is the score most teams triage last. That is exactly why CVE-2026-0257 deserves your morning. It is an authentication bypass in Palo Alto Networks GlobalProtect that carried a mid-range severity rating and then turned into a reliable front door for the Qilin ransomware crew. Palo Alto shipped the fix on May 13. Attackers were through it by May 17. By June, Arctic Wolf Labs was investigating full domain-wide encryption events that all began at that one appliance. The patch closes the door. It does not tell you whether someone already walked through in the weeks it stood open.

That gap, between "we patched" and "we know we were not hit," is the whole story for defenders here.

Who is actually exposed

Two numbers are circulating, and they measure different things. Shadowserver counts more than 167,000 GlobalProtect portals reachable from the internet. Shodan fingerprints over 172,000 addresses. Neither is a count of vulnerable devices. CVE-2026-0257 is reachable only in a specific condition: when authentication override cookies are enabled alongside particular certificate settings on the portal or gateway. A GlobalProtect box without that setup is exposed to the internet but not to this bug.

So before you treat the exposure figure as your risk, confirm your own portal and gateway configuration. The population that needs emergency attention is smaller than the raw scan totals, and knowing which side of that line you sit on is the first triage decision you make today.

What the flaw grants an attacker is narrow and serious at the same time. It lets an unauthenticated remote user skip the login check and stand up a VPN session with no valid credentials. No code execution on the appliance, no dramatic crash. Just a foothold on the inside of your network wearing a legitimate-looking VPN session.

The timeline is the argument for why the score misled people. Palo Alto disclosed and patched on May 13. Rapid7 reported exploitation in the wild by May 17, four days later. CISA added the CVE to its Known Exploited Vulnerabilities catalog on May 29 with the usual federal deadline. Through June, Arctic Wolf documented several separate intrusions that all started with this bypass and ended in Qilin ransomware. A 7.8 that hands a ransomware affiliate an authenticated position inside the perimeter is operationally more dangerous than plenty of 9.8 remote-code bugs that need a chain to reach anything worth stealing. CVSS scores the vulnerability. It does not score what the vulnerability is worth to a ransomware supply chain.

The bypass is quiet, the intrusion is loud

Here is the detection problem. The initial access leaves almost nothing at the perimeter. A successful bypass looks like a VPN session, because it is one. You will not find it by hunting failed logins. Detection has to move inward, to what the affiliates do once they are on the network, and by Arctic Wolf's account they are noisy once inside.

The reported tradecraft is a standard hands-on-keyboard ransomware playbook, and every step is a place to catch it:

• Credential theft by dumping lsass.exe memory and extracting the Active Directory NTDS.dit database. Both are high-signal events on a domain controller if you watch for them.
• Persistence through registry Run keys and scheduled tasks, plus remote-access tooling that has no business on a server: AnyDesk, LogMeIn, MeshAgent, and the ngrok tunneler.
• Lateral movement with PsExec over administrative shares and RDP using the freshly stolen admin accounts.
• Reconnaissance with SoftPerfect Network Scanner and NetExec.
• Data theft ahead of encryption using Rclone, FileZilla, Proton Drive, and MEGA in the double-extortion cases.
• Anti-forensics: clearing Windows event logs and disabling Microsoft Defender, with the payload staged under C:\PerfLogs and often shipped as a password-protected win.exe.

None of that is exotic, and that is the point. The affiliates do not need to be subtle on the inside because the appliance let them skip the loud part at the edge. If your detection depends on catching the intrusion at the perimeter, this campaign is built to beat it. If you are watching for LSASS access, sudden event-log clears, Defender being switched off, or an AnyDesk install on a domain-joined server, you get several chances to catch it before the encryptor runs. We made the same login-first argument about the Kairos crew, who stole two terabytes and never encrypted a file: watch the access, not just the file locker.

The perimeter box is the ransomware supply chain now

Step back and this is not really a Palo Alto story. It is the shape we keep writing up. FortiBleed turned harvested Fortinet session material into Lynx and Inc ransomware. Inc ransomware built a whole operation on unpatched edge appliances without ever touching a zero-day. WatchGuard, SonicWall, Fortinet, and now Palo Alto: the internet-facing security appliance has become the preferred first hop for ransomware-as-a-service, because one reliable bypass sells to every affiliate in the program.

The variability Arctic Wolf saw across intrusions, some racing straight to encryption and others running full double-extortion, is the RaaS model showing through the wire. Different affiliates, one exploit, the same entry appliance. When you can buy access to a working edge exploit, initial access stops being the hard part of a ransomware operation. That is why a mid-severity authentication bypass on a widely deployed VPN earns the same urgency you would give a critical remote-code bug.

Confirm the cookie config, then hunt the May window

Two jobs, in order. First, if you run GlobalProtect and have not applied the May 13 update, that is today's work, not this quarter's. While you are in the configuration, check whether authentication override cookies are enabled with the certificate setup that makes the bypass reachable. That single check tells you whether you were ever in the exposed population.

Second, and this is the part the patch does not cover, assume the window from mid-May to now was open and go hunt it. Pull VPN session logs for connections with no matching authentication event, then pivot to the endpoints: LSASS access on domain controllers, cleared security logs, Defender tampering, unexpected remote-access agents, anything staged in C:\PerfLogs. Patching is how you close the door. Hunting the window is how you learn whether the door mattered.