Qilin Ransomware Attackers Exploit PAN-OS Authentication Bypass for Initial Access

Threat actors have been observed exploiting a now-patched high-severity Palo Alto Networks PAN-OS vulnerability as an entry point to deploy Qilin (aka Agenda) ransomware on victim environments. Arctic Wolf Labs said it investigated multiple intrusions in June 2026 that began with the exploitation of CVE-2026-0257 (CVSS score: 7.8), an authentication bypass flaw affecting the portal and gateway

The article reports that Qilin ransomware affiliates are exploiting CVE-2026-0257, an authentication bypass in Palo Alto Networks PAN-OS GlobalProtect portal and gateway components, to gain unauthorized VPN access and deploy ransomware[1][2]. Palo Alto Networks says the issue affects firewalls with GlobalProtect portal or gateway configured under specific cookie and certificate conditions, and limited exploit attempts have been observed on unpatched devices[11]. RealGround analysis: this is primarily a perimeter compromise and ransomware initial-access issue rather than an AI-specific threat, but it is relevant to AI governance because any compromised network edge can expose AI systems, data pipelines, and credentials if they are reachable from the affected environment.