Qilin Ransomware Attackers Exploit PAN-OS Authentication Bypass for Initial Access

Threat actors exploited a patched high-severity PAN-OS authentication bypass vulnerability (CVE-2026-0257, CVSS 7.8) to deploy Qilin ransomware on victim environments. Arctic Wolf Labs investigated multiple June 2026 intrusions where the flaw served as an entry point. The vulnerability affects the portal and gateway of Palo Alto Networks firewalls.