Qilin Ransomware Affiliates Abuse CVE-2026-0257 to Gain Unauthorized VPN Access

Qilin ransomware affiliates are actively exploiting the critical PAN-OS GlobalProtect authentication bypass CVE-2026-0257 to establish unauthorized VPN sessions on unpatched Palo Alto Networks appliances, enabling initial access that leads to credential theft, lateral movement (PsExec, RDP), persistence (registry Run keys, scheduled tasks), data exfiltration (Rclone, cloud storage) and deployment of Qilin ransomware with both encryption-only and double-extortion outcomes.