In short: On 13 May 2026 Palo Alto Networks patched CVE-2026-0257, a high-severity flaw (CVSS 7.8) in its corporate GlobalProtect VPN gateway that lets an attacker log in with no username or password by forging authentication cookies. Through the summer of 2026 the Qilin ransomware crew turned it into a weapon: they slip through the vulnerable VPN into a company network and deploy their encryptor within hours. Below is how the bypass works, who is at risk and what to do.
What happened
GlobalProtect is Palo Alto Networks' corporate VPN gateway: staff use it to reach the work network from home or on the road. In May 2026 the vendor shipped a patch for CVE-2026-0257, then raised its urgency after learning the flaw was being actively exploited. The root cause: the gateway trusted so-called "authentication override" cookies without properly checking their authenticity and integrity. With that feature enabled and a specific certificate configuration in place, an attacker could forge such a cookie and establish a VPN session without knowing any login or password.
PAN-OS 10.2, 11.1, 11.2 and 12.1 are affected, along with Prisma Access 10.2.0 and 11.2.0; Cloud NGFW is not impacted. The US agency CISA added CVE-2026-0257 to its Known Exploited Vulnerabilities (KEV) catalog. This is not the first time a perimeter device has become the front door into a network — we covered a similar authentication bypass in a Check Point firewall.
How the login bypass works
In the industry's weakness taxonomy this maps to "reliance on cookies without validation and integrity checking." In plain terms, the gateway took a special service cookie at face value and used it to decide that a user had already been verified. By forging that token, the attacker convinced GlobalProtect that a login had already happened and received a full VPN session inside the perimeter — the place normally reserved for trusted employees.
Arctic Wolf Labs documented a series of such intrusions in June 2026. The attackers opened GlobalProtect SSL VPN sessions from machines identifying themselves with the hostname "kali" and overlapping IP addresses — a sign of shared exploitation infrastructure.
What Qilin does after getting in
Once inside the network, the Qilin ransomware operators moved fast. They dumped credentials from the memory of the LSASS process and extracted the domain password database (NTDS) using the Install From Media method, hijacked administrative accounts and spread across the network with PsExec and Windows administrative shares. They staged the encryptor in C:\PerfLogs\ and ran it, exfiltrating some data to MEGA cloud storage via the Rclone tool first — classic double extortion: steal, then encrypt. Finally they wiped logs to destroy the evidence.
The result for the victim is an encrypted estate, stolen data and a ransom demand. And it all starts with a single forged cookie on a publicly reachable VPN gateway.
What it means for an ordinary user
It is important not to confuse two very different "VPNs." GlobalProtect is a corporate remote-access gateway that sits on a company's perimeter; it is not the consumer privacy service you install on your phone. So this flaw does not touch your personal VPN app. But if your employer, bank or another service you rely on ran a vulnerable GlobalProtect, your data could have ended up in the hands of ransomware operators along with the whole corporate network.
The broader lesson: a device that is supposed to guard access can, when misconfigured and left unpatched, become the door into the attack itself. VPN security is defined not only by how the channel is encrypted, but by how logins are verified and how quickly patches are applied.
How to protect yourself
Administrators — patch immediately. Install the fixed PAN-OS releases (for example 12.1.7, 11.2.12, 10.2.18-h6 or the relevant hotfixes), disable the Authentication Override feature, restrict access to the GlobalProtect portal to trusted IP addresses, and force users to re-authenticate after the upgrade. Review logs for suspicious VPN sessions.
Ordinary users — tighten your personal hygiene. Turn on two-factor authentication everywhere you can, use unique passwords in a manager and watch login alerts. This will not stop someone else's server being breached, but it lowers what a leak costs you.
Protect your connection on untrusted networks. A personal no-logs VPN encrypts your traffic and replaces your real IP with a server address, so the foreign network you are on (open Wi-Fi, a cafe, a hotel) cannot see what you send. Be clear on the limit: such a VPN protects data in transit and your privacy online — it does not fix someone else's corporate gateway or undo a breach of a server you do not control. It is one layer, not a cure-all. LiMP VPN is a no-logs service for iOS and Android — see the plans and follow more security news on our blog.
Sources
Based on the official advisory from Palo Alto Networks, the attack analysis by Arctic Wolf Labs and reporting by BleepingComputer. The vulnerability is listed in the CISA KEV catalog of actively exploited flaws.