Palo Alto says Qilin and INC ransomware crews keep exploiting patched PAN-OS VPN flaw
Palo Alto Networks says it continues to see ransomware actors abuse an authentication bypass in PAN-OS and Prisma Access that lets attackers set up unauthorized VPN connections.
Palo Alto Networks says it is still seeing ransomware actors exploit a security flaw in PAN-OS and Prisma Access, according to reporting by The Hacker News. The flaw is an authentication bypass in the GlobalProtect portal and gateway that lets an attacker get around security restrictions and set up an unauthorized VPN connection.
The vendor attributed the activity to the Qilin and INC ransomware groups, the report says. The flaw was patched in May 2026, and the report describes it as now patched, which means the exposure is concentrated on systems that have not been updated.
The bug is tracked as CVE-2026-0257 and carries a CVSS score of 7.8. Palo Alto's advisory says Panorama and Cloud NGFW are not affected.
Why it matters: an authentication bypass on a remote-access gateway can hand an outsider a foothold that looks like a legitimate VPN session, and the involvement of ransomware crews raises the stakes for anyone still running older builds. The report does not detail how the groups used the access afterward.
For defenders, the practical step is to confirm which PAN-OS and Prisma Access versions are in use and move to the fixed releases listed in the vendor advisory. Treat unexplained GlobalProtect sessions as worth investigating, and check whether MFA prompts or VPN logins line up with known users and devices.
CVE references
Sources
- Qilin and INC Ransomware Groups Exploit Palo Alto Networks Flaw to Bypass MFAPrimarythehackernews.com
If something here is wrong, tell us. Every correction is listed on the corrections page.
Don’t Just Read About Cyberattacks. Learn How They Work.
Go beyond the headlines. Explore hands-on cybersecurity labs, understand real-world vulnerabilities, and build practical security skills with HackZoneLabs.
Start Learning