CVE-2026-0257 is an authentication bypass in Palo Alto Networks PAN-OS that allows an unauthenticated attacker to establish a valid GlobalProtect VPN session without credentials. The vulnerability affects the GlobalProtect portal and gateway when authentication override cookies are enabled alongside specific certificate configurations. Palo Alto issued a patch on 13 May 2026. Four days later, Rapid7 observed active exploitation in the wild. Qilin ransomware affiliates are now using it as their primary initial access vector, moving from perimeter compromise to domain-wide encryption in under eight hours in multiple confirmed intrusions.

This guide covers what the exploitation looks like at each stage, the detection opportunities available to defenders, and Sigma rules and KQL queries to surface the attack chain across network and endpoint telemetry.

The Attack Chain

Understanding what to detect requires understanding what happens. Arctic Wolf’s incident analysis of confirmed Qilin intrusions via CVE-2026-0257 reveals a consistent sequence:

  1. Initial access: Unauthenticated attacker sends a crafted HTTP request to the internet-facing GlobalProtect portal (TCP/443). The request exploits the authentication override cookie mechanism to generate a valid VPN session without credentials. No user interaction required.

  2. Reconnaissance: Within minutes, the authenticated VPN session is used to conduct rapid network enumeration — identifying domain controllers, file servers, backup infrastructure, and admin shares.

  3. Credential harvest: The attacker pivots to Active Directory. Methods observed include LDAP enumeration, LSASS dumping, and DCSync on under-monitored domain controllers.

  4. Lateral movement and staging: Stolen credentials are used to authenticate to high-value systems. Ransomware staging files and tools (rclone for exfiltration, ransomware binaries) are copied to file shares accessible from multiple systems.

  5. Detonation: Ransomware is deployed via Group Policy Object (GPO) or WMIC broadcast, encrypting as many systems simultaneously as possible before detection.

The eight-hour window from step one to step five is the operational frame you’re working within. Detection needs to occur at steps one or two to provide meaningful time for containment.

Detection Point 1: Anomalous VPN Session Establishment

The primary detection opportunity is at the perimeter — identifying VPN sessions that originate from sources that have never authenticated before, at unusual hours, or that do not match any known user device or geography.

What to look for in GlobalProtect logs:

  • New VPN sessions from IP addresses that have never authenticated to this tenant
  • VPN sessions with unusually short authentication round-trip times (exploitation completes faster than human authentication)
  • Authentication events with a CookieAuthentication auth method where cookie-based auth should not be expected from that source
  • Sessions where the client certificate presented does not match any managed device certificate

Sigma rule — anomalous GlobalProtect session:

title: Anomalous GlobalProtect VPN Session Authentication
id: 9c3a1f8e-7b2d-4e5a-a1c6-3f9d2e8b1a7c
status: experimental
description: Detects GlobalProtect VPN authentications using override cookies from new or unexpected source IPs
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
  - https://arcticwolf.com/resources/blog/exploitation-of-cve-2026-0257-leads-to-qilin-ransomware/
logsource:
  product: palo_alto_panorama
  service: globalprotect
detection:
  selection:
    AuthMethod: 'CookieAuthentication'
  filter_known_sources:
    SourceIP|contains:
      - '10.'
      - '192.168.'
      - '172.16.'
  condition: selection and not filter_known_sources
falsepositives:
  - Legitimate remote users authenticating from new external IP addresses
level: medium
tags:
  - attack.initial_access
  - attack.t1190
  - attack.t1078.001
  - cve.2026-0257

KQL (Sentinel / Defender for Cloud) — new VPN source IP:

// Flag first-seen GlobalProtect authentications from external IP addresses
let known_vpn_ips = 
    CommonSecurityLog
    | where TimeGenerated between (ago(90d) .. ago(1d))
    | where DeviceVendor == "Palo Alto Networks"
    | where DeviceProduct == "PAN-OS"
    | where Activity contains "GlobalProtect"
    | summarize by SourceIP;
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where DeviceVendor == "Palo Alto Networks"
| where DeviceProduct == "PAN-OS"
| where Activity contains "GlobalProtect" and Activity contains "auth"
| where SourceIP !in (known_vpn_ips)
| where not (SourceIP startswith "10." or SourceIP startswith "192.168." or SourceIP startswith "172.")
| project TimeGenerated, SourceIP, DestinationIP, Activity, AdditionalExtensions
| order by TimeGenerated desc

Detection Point 2: Rapid Post-Authentication Enumeration

Legitimate VPN users log in and then access a small set of resources — their work applications, file shares, maybe email. A compromised session starts differently: immediate, broad network scanning and directory enumeration within seconds of VPN authentication.

Sigma rule — LDAP enumeration immediately post-VPN auth:

title: LDAP Enumeration Within 5 Minutes of New VPN Session
id: 4d8b2e1f-9a3c-4f7d-b5e8-2c6d1a9f3b4e
status: experimental
description: Detects LDAP enumeration activity immediately following a new VPN authentication event, consistent with post-exploitation reconnaissance
logsource:
  category: network_connection
  product: windows
detection:
  selection_ldap:
    EventID: 3
    DestinationPort:
      - 389
      - 636
      - 3268
  filter_legitimate:
    Image|contains:
      - '\Microsoft Office'
      - '\Program Files\Microsoft'
  condition: selection_ldap and not filter_legitimate
timeframe: 5m
falsepositives:
  - IT administration tools running LDAP queries
  - Domain-joined application servers performing directory lookups
level: high
tags:
  - attack.discovery
  - attack.t1069.002
  - attack.t1087.002

KQL — rapid AD enumeration following VPN auth:

// Detect LDAP traffic spike from IP that just authenticated to GlobalProtect
let vpn_auth_events =
    CommonSecurityLog
    | where TimeGenerated > ago(2h)
    | where DeviceVendor == "Palo Alto Networks"
    | where Activity contains "GlobalProtect" and Activity contains "auth"
    | project VPNAuthTime=TimeGenerated, VPNSourceIP=SourceIP;
NetworkAccessTraffic
| where TimeGenerated > ago(2h)
| where DestinationPort in (389, 636, 3268)
| join kind=inner (vpn_auth_events) on $left.SourceIP == $right.VPNSourceIP
| where TimeGenerated between (VPNAuthTime .. datetime_add('minute', 10, VPNAuthTime))
| summarize LDAPConnections=count(), Destinations=dcount(DestinationIP) by SourceIP, VPNAuthTime
| where LDAPConnections > 20 or Destinations > 5
| order by LDAPConnections desc

Detection Point 3: DCSync from New Source

DCSync is a high-fidelity indicator of credential theft targeting. A DCSync request from an IP address that authenticated to GlobalProtect for the first time within the last hour is almost certainly attacker activity.

Sigma rule — DCSync from recently-authenticated VPN source:

title: DCSync Replication Request from Recently VPN-Authenticated Host
id: 7f2c4a9e-1b5d-3e8f-c2a7-5d1b9e4f2c3a
status: experimental
description: Detects DCSync (directory replication from non-DC) following a recent first-seen VPN session, indicating post-exploitation credential harvesting
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4662
    ObjectType|contains:
      - 'domainDNS'
      - 'domainPolicy'
    Properties|contains:
      - '1131f6aa-9c07-11d1-f79f-00c04fc2dcd2'  # DS-Replication-Get-Changes
      - '1131f6ab-9c07-11d1-f79f-00c04fc2dcd2'  # DS-Replication-Get-Changes-All
  filter_dc:
    SubjectUserSid|startswith: 'S-1-5-21'
    SubjectDomainName: '*'
  condition: selection
falsepositives:
  - Legitimate AD replication from domain controllers
  - Azure AD Connect sync processes
level: critical
tags:
  - attack.credential_access
  - attack.t1003.006

KQL — DCSync attempt:

SecurityEvent
| where EventID == 4662
| where ObjectType contains "domainDNS"
| where AccessMask == "0x100"
| where Properties has "1131f6aa-9c07-11d1-f79f-00c04fc2dcd2"
    or Properties has "1131f6ab-9c07-11d1-f79f-00c04fc2dcd2"
| where SubjectDomainName != "NT AUTHORITY"
| project TimeGenerated, SubjectAccount=SubjectUserName, SubjectDomain=SubjectDomainName, 
    IpAddress, Computer, Properties
| order by TimeGenerated desc

Detection Point 4: Rclone Exfiltration Before Encryption

Qilin affiliates exfiltrate before encrypting. Rclone is the most commonly observed tool for bulk data transfer to cloud storage endpoints (Mega, S3, Backblaze). A new rclone process executing from an unexpected path or user context is a reliable pre-ransomware indicator.

Sigma rule — rclone exfiltration tool execution:

title: Rclone Data Exfiltration Tool Execution
id: 2e5f8c1d-6a4b-3f9e-d8b2-1c7a4f9e5d2b
status: stable
description: Detects execution of rclone with cloud sync arguments, commonly used in pre-ransomware data exfiltration
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\rclone.exe'
  selection_args:
    CommandLine|contains:
      - 'copy'
      - 'sync'
      - 'move'
  filter_legit:
    CommandLine|contains:
      - '--config'
  condition: selection and selection_args
falsepositives:
  - Legitimate rclone usage by backup or sync teams
level: high
tags:
  - attack.exfiltration
  - attack.t1048.003
  - attack.t1537

Detection alone is insufficient here. The attack chain moves faster than most SOC response times if detection relies solely on post-exploitation signals.

If you have not patched: Patch PAN-OS immediately. CVE-2026-0257 has been actively exploited since May 17 — every day of exposure is a day of potential compromise you may not have detected yet.

Audit authentication override cookie configuration: The vulnerability is only exploitable when authentication override cookies are enabled. If your GlobalProtect deployment does not require this feature, disable it while patching is completed.

Restrict GlobalProtect management surface: The portal interface should not be accessible from the internet unless required. If it is internet-facing, ensure it is behind a dedicated external IP with strict geo-restrictions where operationally feasible.

Alert on first-seen VPN source IPs during off-hours: The highest-fidelity signal for this specific exploitation pattern is a VPN authentication from a source IP that has never connected before, outside of business hours. This combination, without a corresponding helpdesk ticket or user notification, warrants immediate investigation.