Qilin and INC Ransomware Groups Exploit Palo Alto Networks MFA Bypass Flaw
Palo Alto Networks has disclosed exploitation of CVE-2026-0257, an authentication bypass vulnerability in PAN-OS and Prisma Access used by Qilin and INC ransomware groups to gain unauthorized VPN access.
Why it matters
This vulnerability allows threat actors to bypass multi-factor authentication controls, potentially resulting in unauthorized access to corporate networks and increasing the risk of ransomware incidents.
SOC impact
Security teams must closely monitor VPN access logs for unauthorized connections potentially linked to this vulnerability. Assess affected assets running PAN-OS or Prisma Access and correlate telemetry for signs of exploitation targeting MFA bypass.
Recommended actions
- Identify assets running affected PAN-OS and Prisma Access versions
- Review VPN and authentication logs for unusual or unauthorized sessions
- Correlate incidents with known Qilin and INC ransomware activity
- Monitor network telemetry for suspicious VPN connection patterns
- Confirm exposure status with Palo Alto Networks official advisory
Executive Summary
Palo Alto Networks has revealed that ransomware groups Qilin and INC are actively exploiting CVE-2026-0257, a critical authentication bypass flaw impacting PAN-OS and Prisma Access. This vulnerability enables attackers to circumvent MFA protections and establish unauthorized VPN connections, presenting a significant risk to network access controls.
Operationally, the exploitation highlights the importance of vigilant monitoring of VPN authentication processes and access logs. Teams should prioritize identifying affected deployments and investigating suspicious VPN activities to detect potential intrusions linked to these ransomware groups. Understanding this attack vector helps to sharpen detection, response, and containment strategies in environments relying on Palo Alto Networks technologies.
SOC Impact
Security teams must closely monitor VPN access logs for unauthorized connections potentially linked to this vulnerability. Assess affected assets running PAN-OS or Prisma Access and correlate telemetry for signs of exploitation targeting MFA bypass.
VPN Access and Authentication Validation
- Identify assets running affected PAN-OS and Prisma Access versions
- Review VPN and authentication logs for unusual or unauthorized sessions
- Correlate incidents with known Qilin and INC ransomware activity
- Monitor network telemetry for suspicious VPN connection patterns
- Confirm exposure status with Palo Alto Networks official advisory
Why It Matters
This vulnerability allows threat actors to bypass multi-factor authentication controls, potentially resulting in unauthorized access to corporate networks and increasing the risk of ransomware incidents.