Cybersecurity

A Shared Certificate Is What Lets Qilin In

Qilin ransomware is entering through PAN-OS GlobalProtect. The flaw only fires when one certificate is shared between two features, so your version list cannot answer it.

CybersecurityBy Servola Tech Desk2026-07-215 min read

AI-assisted, edited by humans. | Editor-in-Chief: Leon Soliman | Editorial standards

A Shared Certificate Is What Lets Qilin In

Key takeaways

Arctic Wolf Labs traced multiple June 2026 intrusions that began with CVE-2026-0257 in Palo Alto Networks GlobalProtect and ended in Qilin ransomware, and the flaw only fires when authentication override is enabled and its cookie certificate is shared with another feature, so a version inventory cannot tell you whether you are exposed.
Open your GlobalProtect portal and gateway authentication settings this week and confirm the authentication override cookie uses a dedicated certificate, because Palo Alto Networks offers that as a workaround and it requires no upgrade window.
The advisory was published on 13 May 2026 and last updated on 3 June, Rapid7 observed exploitation from 17 May, and CISA added it to the Known Exploited Vulnerabilities catalogue on 29 May with a three-day deadline for federal agencies, so the public timeline moved faster than most change advisory boards meet.
Once inside, the intrusions dumped LSASS, extracted NTDS, moved with PsExec and administrative shares, staged the ransomware in C:\PerfLogs\ and cleared Windows event logs enterprise-wide, which means your post-incident evidence is the first thing this actor removes.
Cloud NGFW is unaffected and Prisma Access has its own fixed builds, so map which of your enforcement points are which before you send anyone a status update claiming the estate is covered.

Ten weeks from advisory to ransomware

Palo Alto Networks published its advisory for CVE-2026-0257 on 13 May 2026 and last revised it on 3 June. The text is measured. It rates the issue high at CVSS 7.8, marks urgency at its highest level, and states that the company has become aware of limited exploit attempts on unpatched PAN-OS devices without mitigations applied.

The rest of the calendar filled in around it. Rapid7 reported observing exploitation in customer environments from 17 May. CISA added the flaw to its Known Exploited Vulnerabilities catalogue on 29 May, which under the binding operational directive gave federal agencies three days to remediate. Then, in June, Arctic Wolf Labs investigated multiple intrusions in which this vulnerability was the initial access vector and Qilin ransomware was the outcome.

Ten weeks separate a measured advisory from an encryption event traced back to it. Nothing in that sequence is unusual. What makes this one worth an hour of your week is that the exposure question here is not the one your tooling is set up to answer.

The flaw lives in a configuration, not in a version

CVE-2026-0257 is an authentication bypass in the GlobalProtect portal and gateway. It allows an unauthenticated remote attacker to bypass authentication and establish a VPN session without valid credentials. That is the headline, and on its own it would be an ordinary patching item.

The precondition is what makes it different. Authentication override is a non-default feature: it lets a portal or gateway issue a session cookie so users do not re-authenticate on every connection, in the manner of a bearer token. The vulnerability only becomes exploitable when the certificate used to encrypt and decrypt those cookies is also used for something else, such as the HTTPS service of the portal or gateway itself. One certificate, two jobs, and the bypass exists.

Read what that does to your inventory. Affected builds run across PAN-OS 12.1, 11.2, 11.1 and 10.2, with fixed versions in each branch, plus Prisma Access 10.2 through 11.2.7-h12. Cloud NGFW is unaffected. But a device on an affected build with authentication override switched off is not exposed, and a device on an affected build with a dedicated certificate is not exposed either. Your asset management system knows the version. It almost certainly does not know the certificate binding. So the question you can answer quickly and the question that determines your risk are two different questions.

What the June intrusions looked like from the inside

Arctic Wolf Labs describes a familiar shape executed competently. After establishing a VPN session without credentials, the operators dumped LSASS and extracted NTDS to harvest credentials, then moved laterally using PsExec and Windows administrative shares. In the double-extortion cases, data left through Rclone to MEGA before anything was encrypted.

Two operational details are worth lifting out. The ransomware was staged in C:\PerfLogs\, a directory the researchers note is rarely monitored by file-integrity tooling. And the operators cleared Windows event logs across the enterprise using PowerShell. Dwell time varied: some cases ran extensive reconnaissance first, others went from access to enterprise-wide encryption quickly.

The log clearing is the part with a planning consequence. If your incident reconstruction depends on local Windows event logs, this actor removes your reconstruction as a routine step, not as a flourish. Forwarding those logs off the host to somewhere the same credentials cannot reach is not an incident-response upgrade. It is the difference between having an investigation and having a guess.

Limited exploit attempts was accurate and unusable

Hold the vendor sentence up against the outcome. On 3 June, Palo Alto Networks had become aware of limited exploit attempts. By the end of June, Arctic Wolf was reconstructing ransomware intrusions that started with the same flaw. Both statements are true, and the first one was never going to warn you about the second.

The reason is structural rather than anything to do with this vendor. A vendor advisory reports what the vendor can see: cases that reached its support organisation, telemetry from customers who share it, incidents disclosed to it. That is a real signal about vendor visibility. It is not a measurement of how many attackers hold the technique, and it cannot be, because the gap between limited attempts and commodity exploitation is closed by a working exploit changing hands rather than by anything the vendor does.

The practical translation is a habit rather than a tool. Read severity language as a description of what has been observed so far, and read the precondition as a description of your own exposure. In this case the precondition is a certificate binding you can check today, and it will still be true in a month when the exploitation language has moved on.

The check that takes an afternoon

Start with the configuration rather than the upgrade, because the workaround Palo Alto Networks offers needs no maintenance window. Open the authentication tabs on each GlobalProtect portal and gateway. If authentication override is disabled, you are not exposed on that device and you can move on. If it is enabled, confirm the certificate used for the authentication override cookie is dedicated to that purpose and shared with nothing else, generating a new one where it is not. That is a change most estates can make in an afternoon, and it holds whether or not the upgrade lands this quarter.

Then do the upgrade properly, per branch, because each PAN-OS line has its own fixed builds rather than one number to remember. And separate your enforcement points on paper first: Cloud NGFW is out of scope entirely, Prisma Access has distinct fixed versions, and a status update that says the estate is patched without that distinction will be wrong in one direction or the other. European operators running these gateways as the boundary of an essential or important entity under NIS2 have the additional problem that the significant-incident clock does not pause while the estate is being mapped.

Frequently asked questions

Are we exposed if we run an affected PAN-OS version?

Not necessarily. The vulnerability requires authentication override to be enabled and the certificate used for its cookies to be shared with another feature, such as the portal or gateway HTTPS service. A device on an affected build with authentication override disabled, or with a dedicated certificate for that cookie, does not meet the precondition. Check the configuration, not only the version.

What is the fastest mitigation if we cannot upgrade this week?

Palo Alto Networks offers two workarounds: disable the authentication override options, or generate a new certificate used exclusively for authentication override cookies and not shared with any other feature. Both are configuration changes rather than upgrades, so they do not need a maintenance window. Upgrading to the fixed build for your branch remains the durable fix.

Why does the ransomware staging directory matter?

Arctic Wolf Labs observed the payload staged in C:\PerfLogs\, which it notes is rarely covered by file-integrity monitoring. A detection rule that watches the usual staging paths will miss it. The same intrusions cleared Windows event logs across the enterprise with PowerShell, so host-local logs cannot be relied on afterwards either.

The version number is the question your tooling can answer in a minute. The certificate binding is the question that decides whether a ransomware crew gets a VPN session, and it takes an afternoon to answer properly.

Palo Alto NetworksPAN-OSGlobalProtectCVE-2026-0257QilinRansomwareCISA KEV

Your MFA Seeds Left Before You Patched

CVE-2026-15409 and CVE-2026-15410 chain into root on SonicWall SMA1000. Stolen TOTP seeds survive the patch, which is why Germany's BSI orders Assume Breach.

5 min read

Cybersecurity

Your Sandbox Was Attacked a Month Before the Warning

CISA catalogued two FortiSandbox flaws on 16 July. Attackers were exploiting them in mid-June, and a third from the same wave is still not listed. If KEV drives your patching, you are late.

4 min read

Law & Regulation

The EA Buyout Now Hinges on Brussels

The largest take-private in history has cleared EA shareholders and US antitrust. The last real gate is the EU - and not classic merger review, but the Foreign Subsidies Regulation, facing its first blockbuster test.

3 min read

← All articles