Patch GlobalProtect to a fixed PAN-OS build now, then hunt for VPN sessions that never authenticated — Qilin is using CVE-2026-0257 as its front door.

Deploy first

PAN-OS GlobalProtect portal and gateway

Act units

1

Release

Palo Alto Networks 2026-05-13

CVEs

1 (by counter)

KEV read

2026-07-21

Report

ITS-EXV-2026-0513

This is a ransomware intrusion story, not a firewall patch story. Qilin operators forge a GlobalProtect authentication-override cookie, walk in as a legitimate VPN user, and are encrypting domains from there. The vulnerability is the doorway; the intrusion is the product. Treat this as an initial-access problem with a ransomware outcome attached, and scope the response accordingly.

The bug is misplaced trust, not a crash. The firewall handed out that remember-me token but never checked, when one came back, that it was genuine. Forge the token and the firewall lets you in as a legitimate remote user — no password, no exploit that crashes anything, no malware on the appliance. That is why it is quiet: there is nothing on the firewall that looks broken afterwards, because from its point of view nothing was.

The window has been open since May. Palo Alto Networks fixed this on 13 May 2026. Rapid7 observed exploitation from 17 May. CISA added it to KEV on 29 May with a 1 June federal deadline and the ransomware flag set. Arctic Wolf Labs then worked multiple June intrusions running from this CVE to domain-wide Qilin encryption.

Patching does not evict anyone already inside. A VPN session, a dumped credential and a deployed remote-access tool all survive the update. If your GlobalProtect portal was exposed and unpatched between 17 May and the day you patched, deployment discharges one obligation and compromise assessment is the other.

Qilin is not a sector specialist — do not use your industry to rule this out. Across 2,038 claimed victims from October 2022 to 21 July 2026, the United States accounts for 907 (44.5%) and all of Europe for 540 (26.5%). By sector the leaders are Manufacturing (304), Business Services (276), a 264-strong bucket the aggregator could not label, Technology (182), Healthcare (179) and Construction (131); Financial Services ranks seventh at 128 (6.3%), and European financial services specifically is 15 victims — 0.7% of the total. This is a high-tempo, broad-spectrum operation taking what its exploits and access brokers give it: 735 claims in the first seven months of 2026, 312 in the last 90 days, roughly 24 a week. If you ran an exposed GlobalProtect portal, the question is whether you were reachable, not whether your sector is on a list.

Neither setting is on by default, so most firewalls are not exposed — but you have to look to know. GlobalProtect can hand a user a 'remember me' token so they are not asked to log in again. Two things must both be true for the flaw to work: an administrator has switched that remember-me feature on, and the certificate that protects the token is also being used for something else — which Palo Alto's own guidance tells you not to do. Neither is a factory setting; both are deliberate choices someone made. That is good news, with a catch: the two settings live on different screens, so 'we run Palo Alto' does not answer the question and neither does 'we patched'. Prisma Access is in scope at certain patch levels; Panorama and Cloud NGFW are not affected at all.

What to deploy, and what to hunt

The cut — why the top unit cannot slip

The intrusion, stage by stage

Every stage below is the reported tradecraft, not a generic ransomware playbook. Read it for one thing above all: the patch cuts step 1 and nothing else. Steps 2 to 9 are already-established access, and step 8 is where the attacker removes the evidence you would use to find steps 2 to 7 — which is why compromise assessment is a separate obligation from deployment, and why it goes stale.

How Qilin operates — ATT&CK layer

Qilin's catalogued tradecraft across the intrusion, 12 tactics and 53 techniques. Pre-intrusion tactics (Reconnaissance, Resource Development) are omitted — they describe the group's preparation, not anything visible in your estate. The two highlighted cells are the ones CVE-2026-0257 delivers directly: T1190 to get in, and T1078 because the product of the bypass is a valid VPN session.

12 tactics · 53 techniques · read 2026-07-21 · kill-chain order, left to right

Who Qilin actually hits

Claimed victims published on Qilin's own leak site, aggregated by ransomware.live and read on 21 July 2026. These are adversary claims, not confirmed breaches — see caveats.

Method, sources, caveats

• This brief does not reprint indicators of compromise, but they exist and are worth collecting. Unit 42 publishes nine probing IP addresses and suspect host IDs. Arctic Wolf publishes a full list in a public GitHub repository. The guidance here is behavioural because behaviour outlasts infrastructure — not because nothing was released.
• One research team, Arctic Wolf Labs, links this flaw to Qilin. The news coverage traces back to that same investigation, so it is one source told several times. The exploitation itself is different: that is confirmed by the vendor and seen by others independently. It is the ransomware connection specifically that rests on a single origin.
• The two CVSS scores disagree — 7.8 under v4.0 and 9.1 under v3.1 — and both are reported here rather than selecting the more persuasive one. The v4.0 vector explains the gap: vulnerable-system impact is low because the damage lands downstream of the firewall, in the network the VPN session opens onto. A queue sorted on a single CVSS number will misplace this either way, which is the standing argument for exploitation status over score.
• The victim and tradecraft figures come from ransomware.live, which aggregates what the group itself publishes on its leak site. These are adversary claims, not confirmed breaches: they exclude victims who paid before publication or were never listed, they can include exaggerated or duplicated entries, and country and sector labels are assigned by the aggregator. Treat the distribution as a shape, not a count — and note that 264 of the 2,038 entries carry no sector label at all, which is larger than the Financial Services total.
• This brief rates how dangerous the flaw is in general. It cannot tell you what to do in your estate. That depends on two facts only you have: is your GlobalProtect portal reachable from the internet, and is the remember-me feature switched on?
• Exploitation did not always become an intrusion. Rapid7 saw successful exploitation across numerous customers but states it did not observe successful lateral movement from the devices, and Unit 42 states no post-access behaviour or lateral movement had been identified at the time of writing. Arctic Wolf's June cases did run to domain-wide encryption. Both are true: a forged VPN session is the precondition for the ransomware outcome, not a guarantee of it. Scope compromise assessment on your own telemetry rather than assuming either the best or the worst case.
• We say neither setting is on by default. That comes from outside analysis, not from Palo Alto. The advisory and the knowledge-base article both tell you how to check the setting. Neither says what it ships as. Nobody publishes how many firewalls have both conditions either. So treat 'most are not exposed' as a fair inference, not a measured fact.

Sources