CVE-2026-0257 Exploited by Qilin and INC Ransomware Groups to Bypass MFA in PAN-OS

Palo Alto Networks reports that ransomware groups Qilin and INC are exploiting the patched CVE-2026-0257 vulnerability in PAN-OS and Prisma Access to bypass Multi-Factor Authentication (MFA). The flaw, addressed in May 2026, allows unauthorized VPN connections, highlighting ongoing risks despite remediation.

Palo Alto Networks has disclosed that it's continuing to observe exploitation of a now-patched security flaw impacting  PAN-OS and Prisma Access by ransomware actors.

The activity relates to CVE-2026-0257 (CVSS score: 7.8), an authentication bypass flaw that could be exploited by bad actors to set up unauthorized VPN connections. It was patched by Palo Alto Networks in May 2026 and was

Read original article