Back Securityaffairs.Co

Qilin Ransomware Affiliates Abuse CVE-2026

Securityaffairs.Co •Pierluigi Paganini • July 21, 2026

Qilin ransomware exploits the PAN-OS GlobalProtect flaw CVE-2026-0257 to gain unauthorized VPN access to unpatched networks. Arctic Wolf researchers warn that the Qilin ransomware gang is exploiting the critical PAN-OS GlobalProtect vulnerability CVE-2026-0257 to compromise corporate networks. CVE-2026-0257 is a PAN-OS authentication bypass vulnerability affecting GlobalProtect portals and gateways. Palo Alto Networks addressed the vulnerability on May […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Qilin Ransomware Gang Exploits Critical Palo Alto VPN Vulnerability The Qilin ransomware gang is actively exploiting a critical authentication bypass vulnerability (CVE-2026-0257) in Palo Alto Networks' PAN-OS GlobalProtect VPN software. This flaw allows attackers to bypass security restrictions and establish unauthorized VPN connections. Palo Alto Networks issued a patch for the vulnerability on May 13, 2026, but exploitation attempts were reported starting May 17. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the vulnerability to its Known Exploited Vulnerability catalog on May 29, mandating federal agencies to secure their systems. Arctic Wolf Labs has documented multiple intrusions leading to Qilin ransomware deployment, indicating ongoing exploitation. Over 167,000 GlobalProtect VPN instances are exposed online, raising concerns about widespread vulnerability. The Qilin ransomware operation has claimed over 2,000 victims since its inception in 2022, affecting high-profile organizations across various sectors. 10 sources 70

Extracted Entities

CVEs (1)

CVE-2026-0257