Qilin and INC Ransomware Exploit Palo Alto Networks Flaw to Bypass MFA

· Cybersecurity

Palo Alto Networks disclosed that it continues to observe exploitation of a now-patched flaw in PAN-OS and Prisma Access by ransomware actors, with the Qilin and INC groups among those using it. Tracked as CVE-2026-0257 with a CVSS score of 7.8, the authentication bypass lets attackers set up unauthorized VPN connections, effectively getting past multi-factor authentication. The disclosure, reported on October 20, shows that even patched perimeter appliances remain a favored entry point for ransomware crews, and that organizations with unpatched devices may already have unauthorized access established.

Why it matters：Edge appliances that gate remote access are a recurring ransomware entry point, and an MFA bypass on a major vendor's platform means organizations must verify whether intrusions already occurred, not just apply the patch.

Key points

  • CVE-2026-0257 is an authentication bypass rated 7.8
  • Exploitation observed against PAN-OS and Prisma Access
  • Attackers use the flaw to set up unauthorized VPN connections

Sources (original reporting)

More stories from this day