Qilin ransomware crews break in through a Palo Alto VPN authentication bypass

Arctic Wolf Labs investigated multiple intrusions in June that began by exploiting an authentication bypass in Palo Alto Networks PAN-OS and ended in Qilin ransomware. CVE-2026-0257 affects the portal and gateway components and lets an unauthenticated remote attacker establish a VPN session without valid credentials, but only where authentication override cookies are enabled alongside specific certificate configurations. That narrow precondition makes it easy to assume you are unaffected without checking. The flaw is patched. Because it grants VPN access rather than code execution, the intrusions look like ordinary remote logins at the start, which delays detection until ransomware is deployed.

Check

Confirm PAN-OS is patched against this flaw and check whether authentication override cookies are enabled with the certificate configurations that make it exploitable, since the precondition is easy to overlook.

Affected

Organizations running unpatched PAN-OS portal or gateway components with authentication override cookies enabled (CVE-2026-0257); attackers establish VPN sessions without credentials, and Qilin affiliates have used this for initial access.

Fix

Patch PAN-OS, disable authentication override cookies where not required, require multi-factor authentication on VPN access, and hunt for VPN sessions lacking a corresponding authentication event or coming from unexpected locations.