Where June’s VPN session records were never retained, installing a fix cannot reconstruct them. The administrator investigating now needs the accounts used, connection times and source addresses. Those records may already be gone.

Ransomware groups have been exploiting CVE-2026-0257 in PAN-OS GlobalProtect since June, according to reporting published on October 21. The flaw lets attackers open virtual private network sessions and enter corporate networks. Palo Alto Networks’ Unit 42 names the ransomware operators Qilin and Inc among those exploiting it.

The warning arrives with an investigation attached. Closing the vulnerable route addresses another entry attempt. Establishing whether somebody already used it requires evidence from before the warning.

A VPN session record can establish that a connection occurred. By itself, it cannot establish everything the connecting party did afterwards. Where records survive, the account and connection time give investigators a starting point for tracing subsequent access. Where they do not, a clean-looking recent history covers only the period it contains.

On September 10, this paper reported active exploitation of Cisco and WatchGuard firewall flaws on the equipment terminating remote access. GlobalProtect now adds an earlier starting point to the same operational problem: the device admitting connections is also a source of evidence about who came through.

The product’s current condition and its access history require separate evidence. A gateway can be fixed today while the investigation still reaches back to June.

Retained VPN session logs, linked to records from the systems reached through those sessions, are the control that preserves that investigation. Without them, closing the entry route leaves earlier access unresolved.