Qilin and INC exploit patched PAN-OS flaw to bypass MFA
Original title: Qilin and INC Ransomware Groups Exploit Palo Alto Networks Flaw to Bypass MFA
Unit 42 says CVE-2026-0257 yields unauthorized VPN sessions, followed by RDP, SMB, and ransomware staging.
Palo Alto Networks Unit 42 says ransomware operators continue exploiting CVE-2026-0257, an authentication-bypass flaw in PAN-OS and Prisma Access patched in May 2026 and added to CISA's KEV catalog on May 13. Spikey Scorpius (Qilin) and Tarnished Scorpius (INC) use it for VPN sessions that bypass MFA, then reconnoiter with RMM tools and move over RDP and SMB. In one case they reached vCenter, disabled ESXi execInstalledOnly, and dumped credentials from a domain controller virtual disk. Unit 42 also reports chaining with the Veeam flaw CVE-2023-27532.
Unconfirmed: Unit 42 names INC, while ReliaQuest names Settra alongside Qilin.
- The flaw has a CVSS score of 7.8.
- ReliaQuest reported Qilin and Settra exploiting it in financially motivated attacks.
- Arctic Wolf previously flagged Qilin's use in July 2026, including double extortion.
- Targeted sectors include healthcare, finance, government, energy, and retail.
- Palo Alto recommends hunting gateway-connected events and starting incident response.
Impact: Unauthorized VPN access that bypasses MFA and enables ransomware staging
| Product | Affected |
|---|---|
| Palo Alto Networks PAN-OS | — |
| Palo Alto Networks Prisma Access | — |
- 1.Apply the latest PAN-OS and Prisma Access fixes for CVE-2026-0257.
- 2.Hunt for successful gateway-connected VPN events and start incident response if found.
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1133 External Remote ServicesT1021.001 Remote Desktop ProtocolT1021.002 SMB/Windows Admin SharesT1003 OS Credential Dumping
- Vendors
- Palo Alto Networks
- Products
- PAN-OSPrisma Access
- Organizations
- Unit 42CISAReliaQuestArctic Wolf
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2023-27532 | Missing Authentication in Veeam Backup & Replication Exposes Stored Credentials | 7.5 | 81% | KEVRansomware | KEV |
| CVE-2026-0257 | Authentication Bypass in Palo Alto Networks PAN-OS GlobalProtect Portal and Gateway | 7.8 | 97% | KEVRansomware | KEV |
From the original article
2 min read at thehackernews.com
Palo Alto Networks has disclosed that it's continuing to observe exploitation of a now-patched security flaw impacting PAN-OS and Prisma Access by ransomware actors. The activity relates to CVE-2026-0257 (CVSS score: 7. 8), an authentication bypass flaw that could be exploited by bad actors to set up unauthorized VPN connections.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.