Qilin and INC Ransomware Groups Exploit Palo Alto Networks Flaw to Bypass MFA

Palo Alto Networks has disclosed ongoing exploitation of CVE-2026-0257, a now-patched authentication bypass vulnerability affecting PAN-OS and Prisma Access. The flaw carries a CVSS score of 7.8 and allows threat actors to establish unauthorized VPN connections, effectively bypassing multi-factor authentication. Two ransomware groups, Qilin and INC, have been observed actively exploiting this vulnerability. Palo Alto Networks patched the flaw in May 2026. The continued exploitation post-patch indicates that many organizations have not yet applied the fix. The activity highlights the growing trend of ransomware actors targeting network edge devices to gain initial access.