Qilin and INC Ransomware Groups Exploit Palo Alto Networks Flaw to Bypass MFA

Palo Alto Networks' Unit 42 reports ongoing abuse of CVE-2026-0257, an authentication-bypass bug in PAN-OS and Prisma Access rated 7.8 on the CVSS scale, which lets attackers create rogue VPN sessions and sidestep multi-factor authentication. The vendor fixed the issue in May 2026 and CISA added it to its Known Exploited Vulnerabilities list on May 13, 2026, yet ransomware crews tracked as Spikey Scorpius (Qilin) and Tarnished Scorpius (INC) — alongside Settra, flagged separately by ReliaQuest — are still using it as an entry point. Once inside, the intruders deploy RMM software for recon, pivot through RDP and SMB, and in some cases jump from the VPN gateway to vCenter, disabling ESXi protections to pull credentials straight from a domain controller's virtual disk, bypassing endpoint defenses entirely. Victims span education, finance, healthcare, manufacturing, government, logistics, energy and retail, with some intrusions also chaining in the older Veeam flaw CVE-2023-27532; Palo Alto urges immediate patching plus proactive hunting for compromise indicators.