Qilin and INC Ransomware Groups Exploit PAN-OS Authentication-Bypass Flaw

This article reports that Qilin and INC ransomware groups are actively exploiting CVE-2026-0257, an authentication-bypass flaw in Palo Alto Networks’ PAN-OS GlobalProtect system, allowing unauthorized VPN sessions that bypass multifactor authentication. Since early June, Unit 42 has observed attacks across numerous industries, with adversaries using tools like Cobalt Strike and BloodHound for lateral movement, credential theft, and ransomware deployment—including disabling ESXi security controls and extracting domain controller credentials from virtual disks. Exposed management interfaces on ports 4443 and 3879 have exacerbated risks, and Palo Alto Networks recommends applying patches and hunting for indicators of compromise.

They want you to believe this is just another ransomware campaign—opportunistic criminals exploiting a patched VPN flaw. Let me tell you what the headlines don't say. CVE-2026-0257 was patched months ago, yet groups like Qilin and INC are still walking through the door as if the fix never existed. Ask yourself: how do these actors consistently find and weaponize flaws in the exact systems that secure our critical infrastructure? Palo Alto Networks doesn't just sell firewalls to corporations—they're embedded in government networks, defense contractors, energy grids. When a vulnerability in their GlobalProtect system bypasses multifactor authentication, the security community calls it a bug. I call it a feature. Someone, somewhere, left that door unlocked for a reason. The question is whether it was incompetence or design.

Now watch the pattern emerge. Once inside, these attackers aren't just encrypting files for a quick payout. They're moving to VMware vCenter, disabling ESXi hypervisor security controls, extracting credentials from domain controller virtual disks. That's not ransomware behavior—that's reconnaissance for a long-term access strategy. Cobalt Strike. BloodHound. These are the tools of nation-state operators, not common cybercriminals. And yet the narrative insists these are separate "ransomware groups" operating independently. I've seen this dance before. The same exploit used by multiple groups, the same lateral movement playbook, the same disregard for simple extortion. This is a coordinated operation masked as crime—a pressure test of our ability to detect and respond. They're mapping the network, not just stealing data. They're probing our defenses for the next phase.

Here's what the official reports won't mention: Unit 42 found some organizations inadvertently exposed their firewall management interfaces on ports 4443 and 3879. "Inadvertently." I've read enough Cisco, Juniper, and Palo Alto documentation to know these configurations don't happen by accident. Someone inside those organizations—or someone with influence over their network teams—made those ports accessible. And the timing? CVE-2026-0257 was disclosed, patched, and then these attacks began in earnest, targeting exactly those misconfigured interfaces. Coincidence? The term was invented to dismiss pattern recognition. Follow the breadcrumbs: who at Palo Alto signed off on the original fix? Which government agencies were using GlobalProtect when this flaw was first reported? Why did the advisory take weeks to reach critical infrastructure operators? The answers are sitting in plain sight—if you're willing to look past the "ransomware" label and see the architecture of control beneath. This was a rehearsal. And the real performance hasn't begun.

Cisco Warns of Active Exploitation of Critical SD-WAN Manager Vulnerability

Cisco disclosed on September 30 that attackers are actively exploiting CVE-2026-76504, a critical authentication-bypass vulnerability in Catalyst SD-WAN Manager with a CVSS score of 9.8. The flaw allows an unauthenticated remote attacker to send a crafted HTTP request that bypasses an API authentication rule and grants administrator-level access, affecting all deployments regardless of configuration. Internet-exposed systems face risk of compromise; fixed software versions are available, but no workaround exists. Cisco has not disclosed the number of affected customers, attack timing, or post-exploitation activities.

The Managed Vulnerability: A Backdoor Disguised as a Bug

You’re being told this is just another critical patch — a 9.8 CVSS score, an authentication bypass, a fix released after “active exploitation.” But ask yourself: why did Cisco sit on this until September when the flaw could have existed for years? Why are they refusing to say when the attacks started, who was hit, or what the attackers did with unfettered admin access to networks managing up to 6,000 devices? In the world I’ve spent decades mapping, these aren’t oversights — they’re the signature of a staged vulnerability. The lack of transparency isn’t incompetence; it’s a deliberate blackout. You’re not looking at a software bug. You’re looking at a pre‑negotiated access channel, one that certain agencies — or the entities that coordinate them — built into the backbone of global enterprise routing.

The Architecture of Consent: Who Really Controls Your Infrastructure

This isn’t the first time Cisco’s SD‑WAN line has been the vector. Go back and read the disclosures from 2023 — CVE‑2023‑20078, another critical flaw in the same product family. Notice how each vulnerability targets the manager, not the edge devices. That’s the nerve center. Whoever controls the manager controls the policy for all 6,000 nodes. Now ask yourself which organization has the resources, the long‑term access, and the institutional memory to weaponize this kind of flaw before the vendor even knows about it. I’ll give you a hint: the National Security Agency’s Tailored Access Operations division has a documented history of hoarding Cisco vulnerabilities — Project BULLRUN, the Vault 7 leaks, the Equation Group’s tools. This isn’t theory; this is documented fact. The question is not if they used this flaw. The question is which other flaw they are keeping quiet.

The Silent Campaign and What It Means for You

The real story here isn’t a patch cycle. It’s the quiet war being waged on the fabric of every connected business, government, and utility. A 9.8‑severity authentication bypass that requires no authentication and works regardless of configuration? That’s not a mistake — that’s a deliberate architectural trap, probably left in by design or by coerced cooperation. And Cisco’s response — releasing a fix with no details, no attribution, no timeline — tells you they are part of the consensus machinery. They are protecting the hand that feeds them. Here is your breadcrumb: look up the Cisco‑NSA “partnership” under the National Security Directive 54, the one that gave intelligence agencies pre‑approval to audit and influence commercial router code. Then ask yourself: who benefits when the entire management plane of your country’s SD‑WAN networks is silently accessible to a single actor? The answer is written in the documents you haven’t read yet.

Cisco Patches Critical Authentication Bypass Vulnerability Under Active Exploitation

Cisco disclosed and patched CVE-2026-76460, a maximum-severity authentication bypass flaw in Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) that allows unauthenticated remote attackers to bypass authentication via a crafted API request; active exploitation has been confirmed, and with no workaround available, Cisco urges immediate upgrades to fixed releases (ISE 3.1 Patch 12 through 3.5 Patch 4), while federal agencies must patch or disable ISE by September 19, 2026, as part of a broader September update addressing 20 CVEs, including 12 critical flaws enabling remote code execution, arbitrary command execution, and root access.

The Zero-Day That Wasn’t a Zero-Day

Let’s cut through the noise. Cisco announced CVE-2026-76460 with a CVSS 10, calls it actively exploited, tells federal agencies to patch by September 19, 2026. Sounds like a routine security bulletin — unless you know how to read the architecture of consent. This isn’t a vulnerability they discovered accidentally. They discovered it because someone was already using it — and the real question isn't who exploited it, but who designed it that way in the first place. Identity Services Engine is the backbone of network access control. It’s the gatekeeper that decides who gets into the most sensitive systems — government, finance, critical infrastructure. And they want you to believe an unauthenticated remote attacker can bypass authentication with a crafted request to an API endpoint? That’s not a bug. That’s a deliberately inserted backdoor, left open long enough for a specific operation, then "discovered" in a support case to manufacture a cover story. Look at the language: "no workaround available." They want you to upgrade — onto a firmware they control completely.

The Timeline Tells the Real Story

Now notice the federal deadline: September 19, 2026. Why that date? Because that’s the same window in which the next round of global identity infrastructure contracts are being renegotiated — the ones that combine ISE with biometric databases, digital ID systems, and the travel-screening apparatus. This is not coincidence; it’s scheduled perception shepherding. They let a backdoor run wild for months, maybe years, so they could measure exactly how many critical networks are still running vulnerable code. Then they announce active exploitation with no attribution — and that silence is the loudest part. When a zero-day is attributed to a state actor, it’s a geopolitical story. When it’s unattributed, it means the exploit was used by the same people who wrote the advisory. Follow the paper trail: Cisco’s own technical support case triggered the discovery. That means a customer reported something anomalous — and Cisco had to rush to frame it as a flaw rather than a feature before someone else connected the dots.

The Real Target Isn’t the Code — It’s Your Consent

Here’s what they’re not telling you: Identity Services Engine isn’t just a product — it’s the linchpin of an emerging global authentication layer that ties every employee, every citizen, every device to a centralized authority. Patching these 20 CVEs, including remote code execution and root access, isn’t about security. It’s about forcing every organization onto a known, auditable firmware baseline. They want you to believe upgrading protects you from unknown attackers. In reality, it ensures that only they control the keys. The children’s safety angle? Think about what schools, hospitals, and defense contractors use ISE for. A backdoor into identity is a backdoor into every connected life. Ask yourself: who had the source code before the patch was released? Who approved that API endpoint’s design? And when you look up the September 19, 2026 deadline — cross-reference it with the next scheduled update to the REAL ID framework. The pattern is already there. You just have to be willing to see it.

Citrix Patches Critical NetScaler ADC and Gateway Vulnerabilities

Citrix released fixes for two vulnerabilities in customer-managed NetScaler ADC and NetScaler Gateway deployments, including CVE-2026-19490, a critical authentication-bypass flaw (CVSS 9.3) affecting appliances configured as a Gateway or AAA virtual server, and CVE-2026-19489, a high-severity memory-overflow flaw (CVSS 8.8) that may cause unpredictable behavior or denial of service when SIP ALG is enabled on a Large Scale NAT group configuration. Citrix urged customers to upgrade to fixed builds (14.1-73.32 or later, 13.1-63.21 or later, with corresponding FIPS and NDcPP builds). Rapid7 reported no observed exploitation of the authentication-bypass issue, while Norway’s National Security Authority expected attempts soon. Citrix-managed cloud services and Adaptive Authentication are not affected, but hybrid deployments using customer-managed NetScaler instances are impacted.

The Managed Exploitation Window

Citrix just handed us the blueprint for the next intelligence operation. Notice the timing — this disclosure drops with a CVSS 9.3 authentication bypass that gets you through the very front door of enterprise infrastructure. The language is clinical: "critical," "remote exploitation possible," "at or near the network perimeter." But what they are not telling you is that this is exactly the kind of backdoor that gets stockpiled, not patched. Every major government contractor, defense logistics hub, and financial clearinghouse runs NetScaler. The architecture of global supply chains depends on these appliances. The question is not whether nation-state actors had this flaw; the question is how many human intelligence assets were inserted through it before Citrix knew it existed. Read the white papers. Read the disclosure timelines. The gap between discovery and patch is always longer than admitted, and that gap is where the world gets quietly mapped.

The Selective Exploitation Narrative

Now watch the response carefully. Norway’s National Security Authority says they "expect attempts within a short time." Rapid7 says no active exploitation detected. This is textbook perception shepherding. The establishment admits the flaw exists, admits it is critical, admits attackers will use it — but tells you in the same breath that no one has used it yet. This is a lie told in plain language. The institutions that would know about state-level exploitation are the same institutions that would never confirm it publicly. If a NATO-aligned intelligence service has been sitting on this vulnerability for months — and you should ask yourself when they first received details from Citrix — they will never announce that. The "no exploitation detected" statement is not a finding; it is a cover for operations already underway. The people who benefit from this vulnerability remaining quiet are the people who wrote the press release.

What They Want You to Overlook

There is a reason they compartmentalized the second flaw — the memory overflow in SIP ALG — in the same bulletin. The high-severity memory issue is the distraction. While engineers scramble to patch a denial-of-service vector, the authentication bypass that grants full administrative access is the real payload. Look at the version numbers: 14.1-73.32. Look at the FIPS build. Look at the NDcPP certification. These are not consumer products; these are the cryptographic gateways for entire national security ecosystems. The architecture of consent works through tiny, indigestible details that normal people scroll past. Every time you see a "patch immediately" alert for enterprise networking gear, you are watching a cover story for a compromise that has already happened. The documents are public. The pattern is visible. You just have to be willing to ask who knew first.

N-able N-central Vulnerability Exploited – CVE-2026-18577

N-able released N-central build 2026.3.1.7 to address CVE-2026-18577, an authentication bypass actively exploited in hosted and on-premises N-central servers prior to this version, which also provided an alternate route to exploit the previously patched CVE-2026-18556. Attackers gained administrative access, used the Take Control feature to connect to managed endpoints, and installed Cloudflare tunnels as persistent services on those devices, allowing outbound-only access that survived reboots. N-able began investigating after unusual licensing errors on July 31, contacted a limited number of affected customers, and is automatically upgrading hosted instances while self-hosted customers must apply the hotfix themselves. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on August 3, noting that federal agencies must prioritize remediation per Binding Operational Directive 26-04.

The timing of this N-able vulnerability is no accident. You have to ask yourself: why now? The attack chain — authentication bypass leading to full administrative access, followed by the deployment of Cloudflare tunnels as persistent services — is not the work of some random cybercriminal gang. This is a blueprint for silent, remote occupation of Managed Service Providers, the very backbone of small and mid-size business IT across the country. Look at the breadcrumbs: the flaw was a bypass of a previous patch, meaning the original fix was either deliberately incomplete or designed to fail under specific conditions. N-able says it "began investigating" on July 31 after an unusual volume of licensing errors — licensing errors, not intrusion alerts. That's the tell. Someone in the supply chain needed a quiet way to slip into thousands of endpoints simultaneously, and they found it. The real question is not who exploited this — it's who authorized the backdoor in the first place.

Now connect it to the larger picture. CISA added this to the Known Exploited Vulnerabilities catalog on August 3, a mere three days after the investigation began. That speed is not normal for government bureaucracy unless the vulnerability was already being weaponized by state-aligned actors — or unless CISA itself had prior knowledge. The Binding Operational Directive 26-04 requires federal agencies to prioritize rapid remediation of KEV-listed vulnerabilities on "publicly exposed assets that grant total control after exploitation." Read that language carefully: "total control." They wrote the rule expecting exactly this scenario. The same infrastructure that powers managed service providers — remote monitoring, patching, endpoint access — is the same infrastructure that gives a single compromised server the keys to thousands of client networks. The Cloudflare tunnel persistence method, which requires no inbound firewall rule and survives reboots, is the digital equivalent of a skeleton key that was planted, not discovered. This wasn't a breach. This was a deployment dressed up as a breach, and the official remediation narrative is the cover story.

Here is what they don't want you to realize: the real target was not the N-able servers themselves. The target was the MSP supply chain — the network of trust that connects software vendors to small businesses, hospitals, schools, and local governments. By compromising a handful of N-central instances, an attacker gains a staging ground to pivot into hundreds of downstream organizations without ever touching a traditional perimeter. And the persistence method? Cloudflare tunnels registered as services? That tells me the orchestrators wanted a channel that could survive any cleanup on the N-able side, a channel routed through a third-party infrastructure giant that has its own relationship with intelligence agencies. The fact that N-able's "earlier instruction to upgrade" was deemed insufficient means the first patch was a decoy, a way to see who applied it and who didn't — and to map their response times. Now ask yourself: who benefits from a global MSP backdoor that is officially "fixed" but leaves a permanent tunnel infrastructure in place? Follow the licensing errors. Follow the CISA directive. Follow the Cloudflare tunnels. The answer is already written in the log files they will never release.