CVE-2026-0257

Qilin and INC Ransomware Groups Exploit Palo Alto Networks Authentication Flaw

Palo Alto Networks has confirmed that ransomware actors from the Qilin and INC groups are actively exploiting CVE-2026-0257, a patched authentication bypass vulnerability in PAN-OS and Prisma Access. The flaw could allow attackers to establish unauthorized VPN connections and bypass multi-factor authentication. Exploitation was first observed following the May 2026 patch release, and affected organizations are urged to update to the latest software versions immediately.