Free tools Windows power users keep installed
One-click scans. No signup required.
CVE-2026-0257 affects GlobalProtect authentication in specific PAN-OS and Prisma Access configurations. Attackers began exploiting it within days of Palo Alto Networks’ May 13, 2026 disclosure, and Arctic Wolf Labs later documented June intrusions in which the flaw provided initial access before Qilin ransomware was deployed. Those cases make the vulnerability consequential well after disclosure—but they do not show that every attacker used Qilin or that exploitation is still occurring in October.
Why this months-old flaw still matters
The risk is not just that a vulnerability was disclosed and then patched. CVE-2026-0257 was observed in exploitation shortly after disclosure, and investigators later tied it to ransomware intrusions. That makes it important for organizations to check their exposure, remediation status, and VPN activity rather than treating the issue as closed because the advisory is months old.
As an Amazon Associate I earn from qualifying purchases.
The timeline also has limits. Rapid7 reported exploitation as early as May 17, four days after Palo Alto Networks published its advisory. Arctic Wolf Labs described multiple intrusions during June in which exploitation was the initial access vector and Qilin ransomware was deployed. The evidence summarized here documents activity through June; it does not establish that exploitation continued into October 2026.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11| Date | Reported development |
|---|---|
| May 13, 2026 | Palo Alto Networks published its security advisory for CVE-2026-0257. |
| May 17, 2026 | Rapid7 reported its earliest observed exploitation and successful exploitation across numerous MDR customers. |
| May 29, 2026 | Unit 42 reported that the vulnerability had been added to CISA’s Known Exploited Vulnerabilities catalog. |
| June 2026 | Arctic Wolf Labs investigated multiple intrusions in which exploitation preceded Qilin ransomware deployment. |
Palo Alto Networks’ advisory now rates the issue High, with a severity score of 7.8, and lists its exploitation status as Attacked. Rapid7 recorded the score changing from 4.7 Medium to 7.8 High as threat information developed; 4.7 is the earlier score, not the current advisory rating.
#1 Best Overall
What CVE-2026-0257 does—and what must be true for exposure
The flaw is an authentication bypass in the GlobalProtect portal and gateway on affected PAN-OS configurations. Under the conditions specified by Palo Alto Networks, an unauthenticated remote attacker can bypass security restrictions and establish a VPN connection.
Configuration and product scope
Exposure depends on the configuration, not just the product name. Palo Alto Networks identifies enabled authentication override cookies and a particular certificate arrangement as relevant conditions. Its advisory lists affected and fixed releases across PAN-OS 10.2, 11.1, 11.2, and 12.1, and Prisma Access 10.2 and 11.2. Panorama and Cloud NGFW are not affected, according to the advisory.
Rank #2
Administrators should use Palo Alto Networks’ CVE-2026-0257 advisory to check the exact deployment, software branch, and release. The advisory is live, and its version guidance can change. A fixed release for one branch should not be assumed to apply to another.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Why a probe is not the same as a VPN session
Rapid7 reported that it found authentication override cookies enabled in investigated environments and Cloud Authentication Service disabled. It observed successful authentication probes in multiple customer environments, but a probe does not by itself establish that an attacker created a full VPN session.
In eight of Rapid7’s ten impacted MDR customers, the appliance accepted a probe but a full VPN session was not established. That is a result from Rapid7’s investigated customer sample, not a rate that can be applied to all vulnerable appliances.
Similarly, in its June 9 update about the activity it was tracking, Unit 42 said only a small portion of probed devices established VPN sessions. At that time, it had not identified post-access behavior or lateral movement in that activity. This time- and activity-specific finding does not rule out follow-on activity in other successful intrusions.
Rank #4
What the Qilin findings establish
Arctic Wolf Labs reported that it investigated multiple June 2026 intrusions where exploitation of CVE-2026-0257 was the initial access vector and Qilin ransomware was deployed. It described cases ranging from rapid encryption-only activity to incidents involving data exfiltration and double extortion. Arctic Wolf said that variation could suggest multiple affiliates operating under Qilin’s ransomware-as-a-service umbrella.
This is evidence from the intrusions Arctic Wolf investigated—not proof that every exploitation attempt involved Qilin, that every successful VPN connection led to ransomware, or that one actor conducted all campaigns. ITPro also reported Arctic Wolf’s Qilin assessment in July. Separately, ITPro quoted Dray Agha, senior manager for Huntress’ security operations center, saying: “The exploitation of this GlobalProtect vulnerability by the Qilin ransomware gang demonstrates that perimeter defences are prime targets.” That is expert commentary reported by ITPro, not a finding attributed to Palo Alto Networks.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How to check and reduce exposure
- Match the deployment to the advisory. Identify the PAN-OS or Prisma Access release and check whether that specific branch and version appear in Palo Alto Networks’ affected-product table. Do not infer exposure or a fix from a different branch.
- Check the relevant configuration. Determine whether authentication override cookies are enabled and whether the certificate arrangement described by the advisory is present. If the conditions do not match, do not assume the deployment is vulnerable solely because it runs GlobalProtect.
- Apply a version-specific fix or stated mitigation. Palo Alto Networks recommends upgrading to the fixed release for the exact software branch. Its advisory also lists two mitigations: use a dedicated certificate exclusively for authentication override cookies, or disable authentication override.
- Coordinate changes across cookie-generating and cookie-accepting components. Palo Alto Networks says all portals and gateways that generate or accept authentication override cookies should be upgraded according to its product-status table to avoid cookie compatibility problems. The vendor FAQ answers “Do I need to upgrade all GlobalProtect components at the same time?” with guidance to upgrade those portals and gateways according to that table.
Because release guidance and compatibility depend on the exact deployment, use the live Palo Alto Networks advisory for the fixed version and mitigation details. The advisory also contains the affected and fixed version table; do not substitute a release number taken from another branch.
What to do if logs show suspicious activity
Unit 42 recommends proactively hunting its listed indicators in GlobalProtect logs. If an event associated with those indicators shows a successful gateway-connected session, activate incident response protocols. Unit 42 directs customers to the security advisory for workarounds, mitigations, and fixed releases, and lists its incident response team as a contact for organizations that believe they may be compromised.
- Distinguish an unsuccessful authentication probe from a successful gateway-connected session; the two represent different evidence of access.
- Review the relevant GlobalProtect logs for Unit 42’s listed indicators and assess successful sessions under your organization’s incident-response process.
- If compromise is suspected, follow incident-response procedures and use the vendor’s advisory for remediation guidance.
Palo Alto Networks’ advisory says: “Palo Alto Networks has become aware of limited exploit attempts on unpatched PAN-OS devices without mitigations applied.” The word “limited” describes the vendor’s statement; it should not be read as assurance that an individual exposed device is safe, particularly given the later intrusion cases documented by Arctic Wolf.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Sources and scope
The technical scope, affected products, mitigations, and current advisory status are from Palo Alto Networks’ CVE-2026-0257 security advisory. Exploitation observations and the sample of MDR customers are from Rapid7. The June 9 activity update and response guidance are from Palo Alto Networks Unit 42. The Qilin-linked intrusion findings are from Arctic Wolf Labs; ITPro reported those findings and the Agha commentary. The documented activity dates in this article run through June 2026, with ITPro coverage in July; they do not establish the vulnerability’s exploitation status in October.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
