Qilin ransomware uses PAN-OS GlobalProtect auth bypass to access networks

Intelligence Summary

A critical PAN-OS GlobalProtect authentication bypass is reportedly being exploited in real ransomware intrusions. The Qilin ransomware gang is using the flaw to gain an initial foothold on victim networks. Once access is established, the attackers can escalate the intrusion and deploy ransomware. The issue matters because VPN auth bypasses can enable unauthorized access without valid credentials. Organizations using affected GlobalProtect deployments should review vendor guidance, check for exposure, and apply mitigations promptly.

Recommended Action

Prioritize immediate review, validate exposure, and patch or mitigate affected systems.

Topics