Qilin and INC exploit patched Palo Alto VPN bypass (CVE-2026-0257)
Original title: Qilin and INC Ransomware Groups Exploit Palo Alto Networks Flaw to Bypass MFA
Unit 42 says the groups still use the May 2026 PAN-OS and Prisma Access fix to open unauthorized VPNs.
Palo Alto Networks says ransomware operators continue to exploit CVE-2026-0257, an authentication-bypass flaw in PAN-OS and Prisma Access that can be used to create unauthorized VPN connections. The issue, scored CVSS 7.8, was patched in May 2026 and added to CISA’s Known Exploited Vulnerabilities catalog on May 13, 2026. Unit 42 named Spikey Scorpius (Qilin) and Tarnished Scorpius (INC) among the operators.
Unconfirmed: This page summarizes a Unit 42 update via The Hacker News and does not include the full report.
- CVE-2026-0257 carries a CVSS score of 7.8.
- Palo Alto Networks patched the flaw in May 2026.
- CISA listed it in the KEV catalog on May 13, 2026.
- Unit 42 links Spikey Scorpius to Qilin and Tarnished Scorpius to INC.
Impact: Authentication bypass to create unauthorized VPN connections
| Product | Affected |
|---|---|
| Palo Alto Networks PAN-OS | — |
| Palo Alto Networks Prisma Access | — |
- 1.Install the May 2026 PAN-OS and Prisma Access fixes if they are not already applied.
- 2.Look for unauthorized VPN connections associated with CVE-2026-0257.
- CVEs
- CVE-2026-0257
- Vendors
- Palo Alto Networks
- Products
- PAN-OSPrisma Access
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-0257 | Authentication Bypass in Palo Alto Networks PAN-OS GlobalProtect Portal and Gateway | 7.8 | 97% | KEVRansomware | KEV |
From the original article
2 min read at databreaches.netRavie Lakshmanan reports: Palo Alto Networks has disclosed that it’s continuing to observe exploitation of a now-patched security flaw impacting PAN-OS and Prisma Access by ransomware actors. The activity relates to CVE-2026-0257 (CVSS score: 7. 8), an authentication bypass flaw that could be exploited by bad actors to set up unauthorized VPN connections.
By Dissent · databreaches.net
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.