Qilin and INC Ransomware Groups Exploit Palo Alto Networks Authentication Flaw

Palo Alto Networks has disclosed that ransomware groups Qilin and INC are actively exploiting a now-patched security flaw in PAN-OS and Prisma Access. Tracked as CVE-2026-0257, the vulnerability carries a CVSS score of 7.8 and is an authentication bypass flaw that could allow bad actors to set up unauthorized VPN connections. The issue impacts PAN-OS and Prisma Access, and was patched by Palo Alto Networks in May 2026.

According to the advisory, the exploitation of this CVE allows attackers to circumvent security controls, specifically enabling unauthorized VPN connections and bypassing multi-factor authentication. While the report notes that exploitation has been observed following the patch release, it does not detail the specific exploit methods used. The activity has been attributed to the Qilin and INC ransomware groups.

The company has urged all customers to update to the latest PAN-OS version to mitigate the risk. Organizations running affected versions should prioritize patching to prevent potential ransomware deployment.