Overview
Threat actors are actively exploiting a critical authentication bypass vulnerability in Palo Alto Networks firewalls to gain unauthorized access to corporate environments and deploy Qilin ransomware, according to new findings from Arctic Wolf Labs.
The flaw, tracked as CVE-2026-0257 (CVSS 7.8), impacts the GlobalProtect portal and gateway in PAN-OS. When specific certificate configurations are combined with authentication override cookies, attackers can bypass authentication and establish seemingly legitimate VPN sessions without valid credentials.
Vulnerability Details
| CVE | Severity | Affected Component |
|---|---|---|
| CVE-2026-0257 | High (CVSS 7.8) | PAN-OS GlobalProtect Portal & Gateway |
Affected Versions
- PAN-OS 12.1
- PAN-OS 11.2
- PAN-OS 11.1
- PAN-OS 10.2 (prior to patched builds)
- Certain Prisma Access releases
Palo Alto Networks has confirmed limited active exploitation in the wild.
Attack Chain
After successfully bypassing authentication and establishing VPN access, attackers rapidly execute post-exploitation activities.
Persistence
Attackers create registry Run keys using a distinctive naming pattern:
*abcdef
*ghijkl
*mnopqr
Pattern:
* + six random lowercase characters
Remote Access Tools Deployed
To maintain access, attackers install legitimate remote administration software:
- AnyDesk
- Ngrok
- LogMeIn
These tools provide multiple fallback access channels.
Credential Theft
Attackers dump credentials from LSASS using:
rundll32.exe comsvcs.dll MiniDump
The output is often disguised as:
*.odt
to evade detection.
Active Directory Compromise
The attackers extract the entire Active Directory database using:
ntdsutil.exe
This enables theft of:
- Domain credentials
- Password hashes
- Service account secrets
- Administrative accounts
Lateral Movement
Observed techniques include:
- PsExec
- Administrative shares (C$)
- Remote command execution
- Credential reuse
Additional Indicators
Researchers observed several compromised systems identifying themselves as:
kali
Multiple attacks also originated from overlapping IP addresses used during both:
- Initial exploitation
- Subsequent VPN access
This suggests shared infrastructure among Qilin ransomware affiliates.
Data Theft Before Encryption
Some affiliates immediately launch ransomware.
Others perform:
- Network reconnaissance
- Large-scale credential harvesting
- Data exfiltration
Exfiltration Tool
Rclone
Storage Destination
MEGA Cloud Storage
Defense Evasion
Before encryption, attackers frequently:
Disable Microsoft Defender
Set-MpPreference -DisableRealtimeMonitoring $true
Clear Windows Event Logs
A PowerShell script is used to erase:
- Security logs
- System logs
- Application logs
- All available event channels
This significantly hinders forensic investigations.
Ransomware Deployment
The Qilin payload is commonly staged as:
C:\PerfLogs\win.exe
The PerfLogs directory is often overlooked by security monitoring tools.
Execution requires a password parameter, complicating automated analysis.
Security Recommendations
1. Patch Immediately
Apply vendor fixes for:
- PAN-OS
- Prisma Access
Addressing CVE-2026-0257 should be the highest priority.
2. Terminate Active VPN Sessions
After patching:
- Force logout all GlobalProtect users
- Revoke existing authentication sessions
3. Rotate Credentials
If compromise is suspected:
- Reset all domain credentials
- Rotate service account passwords
- Reset privileged accounts
- Rotate the KRBTGT account
4. Monitor PerfLogs
Alert on execution from:
C:\PerfLogs\
especially:
win.exe
5. Centralize Logging
Forward Windows Event Logs to:
- SIEM
- Log server
- Security monitoring platform
to preserve evidence even if local logs are erased.
Key Takeaway
CVE-2026-0257 is being actively weaponized by Qilin ransomware affiliates to bypass VPN authentication, obtain domain-wide access, steal credentials, exfiltrate data, and deploy ransomware. Organizations running vulnerable PAN-OS or Prisma Access deployments should patch immediately, invalidate active VPN sessions, and investigate for signs of compromise.
