Qilin and INC Ransomware Groups Exploit Palo Alto Networks Flaw to Bypass MFA
Summary
Palo Alto Networks has reported continued exploitation of a vulnerability in their PAN-OS and Prisma Access software. The flaw, identified as CVE-2026-0257, allows attackers to bypass multi-factor authentication (MFA) and establish unauthorized VPN connections. This vulnerability was patched by Palo Alto Networks in May 2026.
IFF Assessment
This vulnerability allows ransomware groups to bypass MFA, enabling them to gain unauthorized access and execute their attacks.
Severity
CISA KEV: Listed as actively exploited. Federal patch due: June 01, 2026. Known ransomware use: Known.
Defender Context
This article highlights the ongoing threat of attackers exploiting known vulnerabilities to bypass critical security controls like MFA. Defenders should ensure all Palo Alto Networks devices are patched against CVE-2026-0257 and monitor for any signs of unauthorized VPN connections or suspicious activity.