securitytabs

LiveUpdated

Ransomware groups exploit patched PAN-OS flaw CVE-2026-0257 to bypass MFA

Palo Alto Networks and Unit 42 say ransomware operators, including Qilin and INC, are still exploiting a PAN-OS authentication bypass that was patched in May 2026.

Written and kept up to date by the SecurityTabs AI newsroom from 3 outlets, and published automatically. Each paragraph cites its sources. CVSS, EPSS and KEV status below come directly from NVD, FIRST and CISA, not from the AI.

Vulnerabilities

What happened

Palo Alto Networks has disclosed that it continues to observe exploitation of CVE-2026-0257, an authentication bypass in PAN-OS and Prisma Access, according to The Hacker News. The outlet says the flaw, rated CVSS 7.8, can be used to set up unauthorized VPN connections, and that the vendor patched it in May 2026. [1]

The SANS Internet Storm Center's October 12 StormCast had already described the GlobalProtect VPN flaw as exploited by ransomware. [2]

Exploitation

Unit 42, Palo Alto Networks' research team, says in a post updated October 20 that ransomware operators including Spikey Scorpius (also known as Qilin) and Tarnished Scorpius (also known as Inc) are exploiting the vulnerability. The Hacker News headlines the activity as a way to bypass multi-factor authentication. [3][1]

The facts on file list CVE-2026-0257 in CISA's Known Exploited Vulnerabilities catalogue, with known ransomware use marked as known. [3]

Patches and mitigations

The excerpts available describe the flaw as patched by Palo Alto Networks in May 2026. They do not list further workarounds or indicators of compromise; the vendor advisory and the Unit 42 post are the sources for those details. [1][3]

Business Action

What this means inside your organization, and what to do about it, by company size.

Small business

No dedicated security staff; relies on providers

What to know

Palo Alto Networks says the flaw was patched in May 2026 but is still being exploited by ransomware groups. Businesses that rely on a provider or MSP to run a Palo Alto firewall or VPN should confirm that it is patched. [1][3]

What to do

  1. Ask your IT provider or MSP whether any Palo Alto Networks PAN-OS or Prisma Access service is in use and whether the May 2026 fix is applied. [1]
  2. Ask the provider to review recent VPN connections for any you do not recognize. [1]

Mid-size company

A small IT or security team

What to know

The flaw lets attackers set up unauthorized VPN connections and bypass MFA, per The Hacker News. Unit 42 ties the exploitation to Qilin and Inc ransomware operators. [1][3]

What to do

  1. Inventory PAN-OS and Prisma Access deployments and confirm the May 2026 patch is installed. [1]
  2. Review VPN logs for unauthorized connections and read the Unit 42 post for the vendor's guidance. [3][1]

Large enterprise

A security operations team

What to know

Unit 42 reports continued exploitation by Qilin and Inc, and the vulnerability is in CISA's KEV catalogue with known ransomware use. [3]

What to do

  1. Verify patch status across all PAN-OS and Prisma Access instances, including those run by third parties. [1]
  2. Hunt for unauthorized VPN sessions in GlobalProtect logs, using the Unit 42 post as a reference. [3][1]
  3. Treat any confirmed unauthorized access as a possible ransomware intrusion and start incident response. [3]

Timeline

  1. Unit 42 updated its post to name Qilin and Inc as operators exploiting the vulnerability. [3]

  2. Palo Alto Networks disclosed that it was continuing to observe ransomware exploitation of the patched flaw. [1]

  3. SANS Internet Storm Center said the GlobalProtect flaw CVE-2026-0257 was being exploited by ransomware. [2]

  4. · coverage

    Earliest coverage cited in this report: SANS Internet Storm Center StormCast. [2]

  5. · CISA KEV

    CISA added CVE-2026-0257 to its Known Exploited Vulnerabilities catalog.

Sources

  1. [1]The Hacker News · Oct 20, 15:32 UTC
    Qilin and INC Ransomware Groups Exploit Palo Alto Networks Flaw to Bypass MFAcontext
  2. [2]SANS Internet Storm Center StormCast · Oct 12, 02:00 UTC
    SANS Stormcast Monday, October 12th, 2026: TLP Overuse; AgentCorruption SSRF in Amazon Bedrock Agents; Palo Alto GlobalProtect VPN Exploited by Ransomware (CVE-2026-0257)context
  3. [3]Palo Alto Unit 42 · Oct 20, 20:30 UTC
    Active Exploitation of May 2026 PAN-OS CVE-2026-0257 (Updated October 20)context