CVE-2026-0257

nvd.nist.gov • July 22, 2026

Authentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS® software allows the attacker to bypass security restrictions and establish an unauthorized VPN connection. Panorama and Cloud NGFW are not impacted by these issues.

Reference CISA's BOD 22-01 and Known Exploited Vulnerabilities Catalog for further guidance and requirements.

Denotes Vulnerable Software Are we missing a CPE here? Please let us know .

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Qilin Ransomware Gang Exploits Critical Palo Alto VPN Vulnerability The Qilin ransomware gang is actively exploiting a critical authentication bypass vulnerability (CVE-2026-0257) in Palo Alto Networks' PAN-OS GlobalProtect VPN software. This flaw allows attackers to bypass security restrictions and establish unauthorized VPN connections. Palo Alto Networks issued a patch for the vulnerability on May 13, 2026, but exploitation attempts were reported starting May 17. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the vulnerability to its Known Exploited Vulnerability catalog on May 29, mandating federal agencies to secure their systems. Arctic Wolf Labs has documented multiple intrusions leading to Qilin ransomware deployment, indicating ongoing exploitation. Over 167,000 GlobalProtect VPN instances are exposed online, raising concerns about widespread vulnerability. The Qilin ransomware operation has claimed over 2,000 victims since its inception in 2022, affecting high-profile organizations across various sectors. 17 sources 70

Extracted Entities

CVE-2026-0257

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)

Platforms (2)