Qilin and INC ransomware exploit Palo Alto flaw to bypass MFA

Palo Alto Networks said ransomware groups Qilin and INC continue to exploit CVE-2026-0257 (CVSS 7.8) in PAN-OS and Prisma Access. The authentication bypass lets attackers set up unauthorized VPN connections; a patch was released in May 2026.

• CVE-2026-0257 (CVSS 7.8) allows authentication bypass
• Flaw affects PAN-OS and Prisma Access
• Patched in May 2026, exploitation continues
• Qilin and INC ransomware groups are attacking