Qilin Ransomware Campaign Exploits PAN-OS CVE-2026-0257 Auth Bypass

The authentication bypass vulnerability CVE-2026-0257 (CVSS 7.8) in the portal and gateway components of Palo Alto Networks PAN-OS is, according to Arctic Wolf researchers, being actively exploited by attackers as an initial access vector for subsequent deployment of the Qilin ransomware (also known as Agenda). The vendor has already released a fix for the vulnerability. Organizations using PAN-OS with authentication override cookies enabled must immediately verify that the patch is installed and audit VPN sessions for signs of unauthorized access.

Technical details of the vulnerability

As reported by Arctic Wolf Labs, in June 2026 the company investigated several incidents that began with exploitation of CVE-2026-0257. The vulnerability affects PAN-OS portal and gateway components and allows unauthenticated remote attackers to bypass the authentication mechanism and establish VPN sessions without valid credentials. The required condition is that authentication override cookies are enabled under certain certificate configurations.

The vulnerability entry is available in the NVD database. The CVSS score is 7.8 (high severity). At the time of publication, the vulnerability has not been added to the CISA KEV catalog.

Attack chain and adversary tactics

According to the researchers, after exploiting the vulnerability the attackers established SSL VPN sessions to obtain authenticated access to the victim’s network. The subsequent attack chain included the following stages:

• Credential harvesting — compromising administrative accounts to expand access
• Lateral movement — using PsExec and Windows administrative shares to move across the network
• Payload deployment — staging the ransomware in the C:\PerfLogs\ directory
• Defense evasion — clearing Windows event logs and disabling Microsoft Defender real-time protection before launching the ransomware
• Persistence — an unusual persistence pattern via the Windows registry: an asterisk character followed by six random lowercase Latin letters

Notably, the ransomware payload was protected with a password, which further complicates automated analysis and detection.

Variability of post-exploitation activity

Despite common patterns in initial access and staging, Arctic Wolf observed significant differences in post-compromise actions across different victims. The researchers identified several scenarios:

• Rapid encryption — large-scale encryption of corporate infrastructure without prior data exfiltration
• Reconnaissance and remote access — deployment of AnyDesk, Ngrok, or LogMeIn tools to enable extended reconnaissance
• Double extortion — large-scale credential theft and data exfiltration to the MEGA cloud service using Rclone, Proton Drive, and FileZilla prior to ransomware execution

In Arctic Wolf’s assessment, this kind of variability is characteristic of the “ransomware-as-a-service” (RaaS) model, in which multiple affiliated groups use a shared initial access infrastructure and a common encryption toolkit, but apply their own preferred post-exploitation methods. This hypothesis is supported by observations of the tactics used, but has not been confirmed by law enforcement or the vendor.

Threat context

Qilin (Agenda) is an active group operating under a RaaS model. The observed pattern, where a single entry point via a vulnerability in a perimeter device is used by different operators with varying post-exploitation techniques, points to a mature operational model for the group. The use of cloud services (MEGA, Proton Drive) for data exfiltration reflects a broader trend of abusing legitimate platforms, which complicates detection at the network monitoring level.

Impact assessment

All organizations using PAN-OS with authentication override cookies enabled on portal and gateway components are at risk. Given the wide adoption of Palo Alto Networks solutions in the enterprise segment and the role of VPN gateways as an entry point into the protected perimeter, the potential impact is significant. Successful exploitation gives attackers full authenticated access to the internal network, which, in the absence of effective segmentation, can lead to complete compromise of the infrastructure.

Recommendations

1. Apply the patch — ensure that PAN-OS is updated to a version that addresses CVE-2026-0257. Check update status against official Palo Alto Networks guidance.
2. Review configuration — audit authentication override cookie settings and certificate configurations on PAN-OS portals and gateways.
3. Conduct retrospective analysis — review VPN session logs for June 2026 for anomalous connections, especially from unknown sources.
4. Monitor indicators — track the appearance of files in the C:\PerfLogs\ directory, the use of PsExec over administrative shares, and unusual Windows registry entries matching the “asterisk + six random letters” pattern.
5. Control remote access tools — identify and block unauthorized use of AnyDesk, Ngrok, and LogMeIn in the corporate environment.
6. Block exfiltration — restrict or tightly control outbound connections to MEGA, Proton Drive, and similar cloud storage services.

This campaign illustrates a typical approach for modern RaaS operations: exploitation of a vulnerability in a perimeter device provides initial access, which is then monetized by various affiliated operators. The top priority is to immediately verify that the CVE-2026-0257 patch is installed on all PAN-OS instances and to perform a retrospective review of VPN logs to detect any compromise that may have occurred before the update.