CVE-2026-0257 is a critical authentication bypass vulnerability in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS software. Exploitation allows attackers to bypass security restrictions and establish unauthorized VPN connections. The vulnerability was patched by Palo Alto Networks on May 13, 2026. Shortly after, Rapid7 observed active exploitation attempts starting May 17, and CISA added the vulnerability to its Known Exploited Vulnerability catalog on May 29, ordering rapid remediation. Arctic Wolf Labs reported multiple intrusions in June 2026 where threat actors exploited this flaw to deploy Qilin ransomware, including full double-extortion attacks, indicating multiple affiliates under the Qilin RaaS umbrella are leveraging this vulnerability. Over 167,000 GlobalProtect VPN instances are exposed online, though the number of unpatched devices is unknown.

Successful exploitation of CVE-2026-0257 enables attackers to bypass authentication on GlobalProtect VPN portals and gateways, granting unauthorized VPN access to victim networks. This access has been leveraged by the Qilin ransomware gang to conduct domain-wide ransomware encryption and extortion campaigns. The vulnerability has been actively exploited in the wild since May 2026, resulting in significant operational and data loss impacts for affected organizations.

Palo Alto Networks released an official patch for CVE-2026-0257 on May 13, 2026. Organizations should apply this patch immediately to remediate the vulnerability. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has mandated federal agencies to secure GlobalProtect VPN instances within three days of May 29, 2026. No alternative mitigations or workarounds are detailed in the advisory; patching is the primary remediation step.