Qilin and INC Ransomware Groups Exploit Palo Alto Networks Flaw to Bypass MFA
Palo Alto Networks has disclosed that it's continuing to observe exploitation of a now-patched security flaw impacting PAN-OS and Prisma Access by ransomware actors. The activity relates to CVE-2026-0257 (CVSS score: 7.8), an authentication bypass flaw that could be exploited by bad actors to set up unauthorized VPN connections. It was patched by Palo Alto Networks in May 2026 and was
Palo Alto Networks has reported ongoing exploitation of a patched security flaw (CVE-2026-0257) by ransomware groups Qilin and INC. The vulnerability allows unauthorized VPN connections and bypasses multi-factor authentication. The flaw was fixed by Palo Alto Networks in May 2026 and flagged by the U.S. Cybersecurity and Infrastructure Security Agency (CSIA) on May 13, 2026.
Unit 42 researchers say the threat actors use the flaw to gain an initial foothold in corporate networks, bypass MFA controls, and establish VPN sessions. Upon successful exploitation, attackers pivot to the virtualization layer, disabling security controls on ESXi hypervisors and obtaining domain-wide credentials. They have also targeted Veeam backup infrastructure by exploiting known flaws.
Organizations are advised to proactively hunt for indicators of compromise and initiate incident response protocols if successful gateway-connected events are detected.
Written by urgent.news from The Hacker News's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
