Threat intel
Qilin and INC Ransomware Groups Exploit Palo Alto Networks Flaw to Bypass MFA
Palo Alto Networks says ransomware actors, including the Qilin and INC groups, continue to exploit a now-patched authentication bypass flaw (CVE-2026-0257) in PAN-OS and Prisma Access to establish unauthorized VPN connections and bypass MFA. The vulnerability was fixed in May 2026, according to The Hacker News.
Palo Alto Networks has disclosed that it continues to observe exploitation of a now-patched security vulnerability affecting PAN-OS and Prisma Access by ransomware actors, according to The Hacker News.
The activity relates to CVE-2026-0257, which carries a CVSS score of 7.8. The flaw is described as an authentication bypass vulnerability that can be exploited by malicious actors to set up unauthorized VPN connections. Palo Alto Networks patched the issue in May 2026.
Per the report, the exploitation activity is linked to the Qilin and INC ransomware groups, which have been abusing the flaw to bypass multi-factor authentication (MFA) protections. The continued exploitation of a patched flaw underscores the risks organizations face when internet-facing security appliances remain unpatched, even months after fixes become available.
VPN gateways and firewall appliances such as those running PAN-OS are frequent targets for ransomware operators, since compromising them can provide a direct path into internal corporate networks. An authentication bypass in such a device effectively removes a key defensive layer, allowing attackers to gain network access as if they were legitimate remote users.
Organizations running affected PAN-OS or Prisma Access deployments that have not yet applied the May 2026 updates should treat this as an urgent priority, given that active ransomware exploitation is ongoing. Security teams are also generally advised to review VPN connection logs for signs of unauthorized access that may predate patching.
Further technical details and indicators were not included in the item text provided. The Hacker News is the source for this report.
Source: The Hacker News
