Qilin and INC Ransomware Groups Exploit Palo Alto Networks Flaw to Bypass MFA

Palo Alto Networks reported that ransomware groups, including Qilin and INC, are exploiting a patched security flaw in PAN-OS and Prisma Access. The vulnerability, identified as CVE-2026-0257 with a CVSS score of 7.8, allows an authentication bypass for unauthorized VPN connections. Although patched in May 2026, Unit 42 continues to investigate network compromises across various industries since June. The activity highlights ongoing attempts by bad actors to bypass MFA using this specific firewall OS flaw.