The **Qilin** ransomware group is exploiting a critical authentication bypass flaw in **Palo Alto Networks**' **PAN-OS GlobalProtect** to breach victim networks, according to cybersecurity company **Arctic Wolf**. **Palo Alto Networks** addressed the vulnerability, tracked as **CVE-2026-0257**, on May 13. The company warned that attackers had already begun abusing it to compromise corporate networks, with **Rapid7** reporting observed exploitation against numerous customers starting May 17. "**GlobalProtect** portal and gateway of **Palo Alto Networks PAN-OS**® software allows the attacker to bypass security restrictions and establish an unauthorized VPN connection," the company stated at the time. "**Palo Alto Networks** has become aware of limited exploit attempts on unpatched **PAN-OS** devices without mitigations applied." ### CISA Mandates Urgent Patching The **U.S. Cybersecurity and Infrastructure Security Agency (CISA)** added the flaw to its Known Exploited Vulnerability catalog on May 29. **CISA** ordered federal agencies to secure their **GlobalProtect** VPN instances within three days, underscoring the severity and active exploitation of the vulnerability. ### Qilin Ransomware Deployment Confirmed On Monday, **Arctic Wolf Labs** revealed it had observed multiple cases where threat actors exploited **CVE-2026-0257** in attacks that culminated in domain-wide **Qilin** ransomware encryption. Evidence collected during these investigations points to multiple **Qilin** affiliates actively exploiting this flaw to breach targets' networks. "**Arctic Wolf** investigated multiple distinct intrusions during June 2026 that resulted in **Qilin** ransomware deployment, all originating from exploitation of **CVE-2026-0257** against **Palo Alto Networks** firewall appliances," **Arctic Wolf** stated. "Post-exploitation tradecraft varied across intrusions, from rapid encryption-only operations to full double-extortion, possibly suggesting multiple affiliates operating under the **Qilin** ransomware-as-a-service (RaaS) umbrella."  *Qilin CVE-2026-0257 attack chain (Arctic Wolf)* **Arctic Wolf Labs** assesses with moderate confidence that intrusions leveraging **CVE-2026-0257** and leading to **Qilin** ransomware deployment are likely ongoing. This assessment is based on extensive scanning activity observed and the **RaaS** model's tendency to distribute successful exploits among multiple affiliates. ### Unpatched Instances Remain a Risk Internet threat watchdog **Shadowserver** currently tracks over 167,000 **GlobalProtect** VPN instances exposed online, while **Shodan** found over 172,000 IPs with a **GlobalProtect** fingerprint. However, it's unclear how many of these are honeypots or have already been patched against **CVE-2026-0257** attacks. ### The Qilin Threat **Qilin** is a Ransomware-as-a-Service (**RaaS**) operation that first emerged in August 2022 under the name "**Agenda**." Since then, it has claimed responsibility for over 2,000 victims on its dark web leak site. The list of victims includes high-profile organizations such as automotive giants **Nissan** and **Yangfeng**, Japanese beer giant **Asahi**, pathology services provider **Synnovis**, publishing giant **Lee Enterprises**, and **Australia's Court Services Victoria**. **Palo Alto Networks**' products and services are used by over 70,000 customers worldwide, including most of the largest U.S. banks and 90% of Fortune 10 companies, making the widespread exploitation of this vulnerability a significant concern for global cybersecurity.