Table of Contents
Palo Alto Networks firewalls running PAN-OS are under active attack from two critical vulnerabilities that security researchers say have already led to full network compromises and ransomware deployments. CVE-2026-0300, a CVSS 9.3 buffer overflow in the User-ID Authentication Portal, gives unauthenticated attackers root-level remote code execution on the firewall itself. CVE-2026-0257, a CVSS 7.8 authentication bypass in GlobalProtect, has been confirmed by Arctic Wolf Labs as the initial access vector in multiple Qilin ransomware intrusions during June 2026. With approximately 225,000 internet-facing PAN-OS instances identified by Shodan, the PAN-OS vulnerability attack surface is one of the largest active security threats facing enterprise networks today.
Key Takeaway
- 🔴 CVE-2026-0300 (Critical, CVSS 9.3): Buffer overflow in the User-ID Authentication Portal (Captive Portal) allows unauthenticated root RCE on PA-Series and VM-Series firewalls. Actively exploited since May 2026. No user interaction required.
- 🟠 CVE-2026-0257 (High, CVSS 7.8): Authentication bypass in GlobalProtect portal and gateway allows attackers to establish VPN sessions without credentials. Arctic Wolf confirmed it leads to Qilin ransomware deployment. Added to CISA KEV catalog May 29.
- 📊 Attack surface: Shodan identifies approximately 225,000 internet-facing PAN-OS instances. Both vulnerabilities are exploitable from the public internet on devices with the affected features enabled.
- 🛡️ Immediate action: Patch to fixed versions, restrict Captive Portal access to trusted networks only, disable authentication override cookies, and terminate all active GlobalProtect sessions after patching.
- 🕵️ Detect compromise: Search GlobalProtect logs for suspicious host IDs (aa:bb:cc:dd:ee:ff, DESKTOP-GP01, GP-CLIENT) and known malicious IP addresses. Check for LSASS dumping, PsExec activity, and files staged in C:\PerfLogs\.
What the PAN-OS Vulnerability Actually Does
Two separate vulnerabilities in PAN-OS, the operating system that runs Palo Alto Networks next-generation firewalls, are being actively exploited in the wild. Understanding what each one does is the first step to knowing whether your organization is at risk.
CVE-2026-0300 — The Root RCE Flaw. This vulnerability is a buffer overflow (CWE-787) in the User-ID Authentication Portal, also known as the Captive Portal. The Captive Portal is a non-default feature that maps IP addresses to usernames for policy enforcement. When enabled and exposed to the internet, an unauthenticated attacker can send specially crafted HTTP packets that overflow a memory buffer, corrupting adjacent memory and allowing arbitrary code execution with root privileges. Root-level access on a firewall means the attacker controls the entire device — they can modify firewall rules, intercept traffic, steal configuration data, and use the firewall as a pivot point to attack the internal network. According to the Palo Alto Networks security advisory, the vulnerability affects PAN-OS versions before 12.1.4-h5, 11.2.4-h17, 11.1.4-h33, and 10.2.7-h34. Cloud NGFW, Prisma Access, and Panorama are not affected.
CVE-2026-0257 — The VPN Bypass Flaw. This vulnerability is an authentication bypass in the GlobalProtect portal and gateway, the VPN component that remote workers use to connect to corporate networks. The flaw is exploitable when authentication override cookies are enabled with specific certificate configurations. Successful exploitation allows unauthenticated attackers to bypass authentication entirely and establish VPN sessions without valid credentials. Once connected, the attacker has the same network access as a legitimate VPN user — direct interactive access to internal resources. Arctic Wolf Labs documented multiple intrusions during June 2026 where CVE-2026-0257 exploitation was the confirmed initial access vector, leading to domain-wide Qilin ransomware encryption. For a broader look at how VPN vulnerabilities are exploited in the Philippines, see our zero trust security guide.
The Attack Chain: From PAN-OS Vulnerability to Ransomware
Arctic Wolf Labs’ investigation of the June 2026 intrusions revealed a consistent attack chain that every IT security team should understand. The progression from initial exploitation to ransomware deployment happened rapidly, with some intrusions moving from perimeter compromise to enterprise-wide encryption with minimal dwell time.
Step 1 — Initial Access: The attacker exploits CVE-2026-0257 to establish an authenticated GlobalProtect VPN session without valid credentials. Unit 42 identified specific source IP addresses used in pre-proof-of-concept exploitation, including 23.128.228.6, 104.207.144.154, 146.19.216.119, 146.19.216.120, and 146.19.216.125. The attackers used suspicious host IDs and device names including aa:bb:cc:dd:ee:ff, 00:11:22:33:44:55, WINDOWS-LAPTOP-001, DESKTOP-GP01, and GP-CLIENT.
Step 2 — Credential Harvesting: Once inside the network via the VPN session, attackers escalate to credential-driven operations. Arctic Wolf observed LSASS dumping (extracting credentials from the Local Security Authority Subsystem Service) and NTDS extraction (extracting credentials from Active Directory domain controllers). Compromised administrative accounts provide the keys to lateral movement.
Step 3 — Lateral Movement: Attackers use PsExec, a built-in Windows administration tool, to execute commands on remote systems via administrative shares. This allows them to move from the initial entry point to domain controllers and critical servers without deploying additional malware that might trigger detection.
Step 4 — Ransomware Deployment: The Qilin ransomware payload is staged in C:\PerfLogs\, a default Windows performance logging directory that is rarely monitored. The ransomware is deployed via PsExec across multiple systems simultaneously. Some intrusions involved rapid encryption-only operations, while others included extensive reconnaissance, deployment of remote-access tools (AnyDesk, Ngrok, LogMeIn), data exfiltration to cloud storage, and double-extortion tactics. The variability is consistent with the RaaS (ransomware-as-a-service) model, where multiple affiliates use shared infrastructure but apply different post-exploitation methodologies.
How to Patch the PAN-OS Vulnerability
Patching is the most critical mitigation for both vulnerabilities. Palo Alto Networks has released fixed versions for each affected branch. The specific version you need depends on your current PAN-OS version.
| Current PAN-OS Branch | Fixed Version (CVE-2026-0300) | Fixed Version (CVE-2026-0257) |
|---|---|---|
| 12.1 | 12.1.4-h5 or later | 12.1.4-h6 or 12.1.7 |
| 11.2 | 11.2.4-h17 or later | 11.2.4-h17, 11.2.7-h14, 11.2.10-h7, or 11.2.12 |
| 11.1 | 11.1.4-h33 or later | 11.1.4-h33, 11.1.6-h32, 11.1.7-h6, 11.1.10-h25, 11.1.13-h5, or 11.1.15 |
| 10.2 | 10.2.7-h34 or later | 10.2.7-h34, 10.2.10-h36, 10.2.13-h21, 10.2.16-h7, or 10.2.18-h6 |
If immediate patching is not possible, apply the following mitigations. For CVE-2026-0300, restrict access to the User-ID Authentication Portal from untrusted networks and the public internet. The Captive Portal should never be exposed to the internet — if it is, disable it immediately and require users to connect via GlobalProtect VPN first. For CVE-2026-0257, disable authentication override cookies on GlobalProtect portal and gateway configurations. If your organization requires authentication override cookies for operational reasons, ensure Cloud Authentication Service (CAS) is enabled, as Rapid7 observed that exploited devices had CAS disabled.
After patching CVE-2026-0257, terminate all active GlobalProtect sessions immediately. This invalidates any unauthorized VPN sessions that may have been established before the patch was applied. Use the following CLI command: request global-protect-gateway disconnect-all. Verify the termination by checking the GlobalProtect logs for any sessions with suspicious host IDs.
How to Detect If Your Network Has Been Compromised
Even if you have already patched, your network may have been compromised before the patch was applied. Active threat hunting is essential. The indicators below come directly from Unit 42 and Arctic Wolf Labs research.
Check GlobalProtect logs for:
- Successful gateway-connected events from known malicious IP addresses: 23.128.228.6, 104.207.144.154, 146.19.216.119, 146.19.216.120, 146.19.216.125, 179.43.172.213, 185.195.232.139, 198.12.106.60, 202.144.192.47
- Successful gateway-connected events using suspicious host IDs: aa:bb:cc:dd:ee:ff, 00:11:22:33:44:55, WINDOWS-LAPTOP-001, DESKTOP-GP01, GP-CLIENT
- Post-proof-of-concept indicators: endpoint_os_version = “Microsoft Windows 10 Pro 64-bit” and source_user_info.domain = empty
Check Windows endpoints for:
- LSASS memory access by unexpected processes (Event ID 4663 or 4656 with access mask 0x1410)
- NTDS.dit access by non-domain-controller processes
- PsExec execution from unexpected source systems (Event ID 4648 with logon process Advapi)
- Files staged in C:\PerfLogs\ directory, particularly executables with random names
- Deployment of remote-access tools: AnyDesk, Ngrok, LogMeIn installed without authorization
Check for Qilin ransomware indicators:
- Encrypted files with .qilin or .agenda extension
- Ransom notes in directories containing encrypted files
- Registry persistence patterns associated with Qilin deployment
- Comprehensive log-clearing activity (security event logs cleared, PowerShell history deleted)
What This Means for Philippine Organizations
The Philippines’ cybersecurity market is projected to reach $282.68 million by 2026, growing at a CAGR of 8.10%, according to CYFIRMA’s threat landscape report. Despite this growth, many Philippine organizations — particularly in healthcare, financial services, and government — operate legacy infrastructure with limited security operations capacity. The CYFIRMA report identified healthcare as the most targeted sector in the Philippines, with ransomware groups like Medusa and Qilin actively paralyzing operations.
For Philippine organizations running Palo Alto Networks firewalls, the PAN-OS vulnerability is not a theoretical risk. The CYFIRMA report documented over 52 million compromised user credentials in Q3 2025 alone, reflecting a rapidly escalating threat environment. The convergence of high internet penetration (83.8%, over 98 million individuals), rapid digital payment adoption (52.8% of transaction volume), and lagging security hygiene creates the exact conditions that CVE-2026-0257 and CVE-2026-0300 exploit. For more on the Philippine threat landscape, see our Philippine data leak analysis covering the 155.6 million account exposure.
Filipino IT security teams should also review their incident response readiness. The incident response plan guide we published provides a 5-step framework for responding to exactly this type of intrusion — from perimeter breach to ransomware deployment. The key lesson from the Arctic Wolf investigation is that the window between initial access and ransomware deployment can be extremely short. Organizations that cannot detect and respond within hours, not days, will face enterprise-wide encryption.
Why CISA Added These to the KEV Catalog
The Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-0257 to its Known Exploited Vulnerabilities catalog on May 29, 2026. The KEV catalog is a binding operational directive for US federal agencies, which are required to patch listed vulnerabilities within a specific timeframe. While the directive does not legally bind private organizations, the KEV listing is the strongest signal that a vulnerability is being actively exploited in the wild and requires immediate attention.
CVE-2026-0300, disclosed on May 5-6, 2026, has not yet been added to the KEV catalog at the time of writing, but Palo Alto Networks has confirmed “limited active exploitation” and eSentire’s Threat Intelligence team assessed with “medium confidence that widespread exploitation may be seen in the near future.” The Cloud Security Alliance published a research note confirming the vulnerability enables root-level remote code execution without credentials or user interaction on affected devices. For the official CISA KEV catalog and binding directives, see the CISA Known Exploited Vulnerabilities page.
Frequently Asked Questions About the PAN-OS Vulnerability
What is the PAN-OS vulnerability?
The PAN-OS vulnerability refers to two critical security flaws in Palo Alto Networks’ PAN-OS operating system: CVE-2026-0300 (CVSS 9.3), a buffer overflow in the User-ID Authentication Portal allowing unauthenticated root RCE, and CVE-2026-0257 (CVSS 7.8), an authentication bypass in GlobalProtect allowing attackers to establish VPN sessions without credentials. Both are actively exploited in the wild.
How do I know if my firewall is affected by the PAN-OS vulnerability?
Check your PAN-OS version against the affected versions. For CVE-2026-0300, affected versions are PAN-OS before 12.1.4-h5, 11.2.4-h17, 11.1.4-h33, and 10.2.7-h34. For CVE-2026-0257, affected versions include PAN-OS 12.1, 11.2, 11.1, and 10.2 branches with specific sub-version cutoffs. Additionally, CVE-2026-0300 requires the Captive Portal (User-ID Authentication Portal) feature to be enabled, and CVE-2026-0257 requires authentication override cookies to be enabled on GlobalProtect.
Can the PAN-OS vulnerability lead to ransomware?
Yes. Arctic Wolf Labs confirmed that CVE-2026-0257 was the initial access vector in multiple intrusions during June 2026 that culminated in Qilin ransomware deployment. Attackers exploited the vulnerability to establish VPN sessions without credentials, harvested administrative credentials via LSASS dumping and NTDS extraction, moved laterally using PsExec, staged ransomware in C:\PerfLogs\, and deployed it across the network.
How many devices are exposed to the PAN-OS vulnerability?
Shodan identifies approximately 225,000 internet-facing PAN-OS instances globally. However, not all of these are vulnerable — only those with the Captive Portal enabled (for CVE-2026-0300) or authentication override cookies enabled on GlobalProtect (for CVE-2026-0257) are exploitable. Organizations should verify whether these features are enabled on their internet-facing firewalls.
What should I do if I cannot patch immediately?
For CVE-2026-0300, restrict access to the Captive Portal from the public internet immediately. Disable the Captive Portal if it is not needed. For CVE-2026-0257, disable authentication override cookies on GlobalProtect portal and gateway configurations. Ensure Cloud Authentication Service (CAS) is enabled. After patching, terminate all active GlobalProtect sessions to invalidate any unauthorized connections.
How is the Philippine government responding to these cybersecurity threats?
The Philippine National Police Anti-Cybercrime Group (PNP-ACG) has intensified online monitoring, and the government is implementing a multi-faceted resilience strategy integrating blockchain and AI for critical infrastructure protection, according to CYFIRMA. However, the overall risk environment remains elevated, requiring private organizations to maintain their own security operations and incident response capabilities rather than relying solely on government agencies.
Disclaimer: This article is for informational and educational purposes only and does not constitute professional cybersecurity advice. Readers should consult qualified cybersecurity professionals and refer to official advisories from Palo Alto Networks, CISA, and relevant authorities before implementing security changes. The author and publisher disclaim any liability for actions taken based on this information.
