CVE-2026-0257 — Qilin and INC ransomware groups exploit PAN-OS authentication bypass CVE-2026-0257 to establish unauthorized VPN connections

98/100

Palo Alto Networks reports continued exploitation by ransomware actors of CVE-2026-0257, an authentication bypass in PAN-OS and Prisma Access that allows unauthorized VPN connections and bypasses MFA. The flaw was patched in May 2026. Organisations should confirm the fix is applied and review VPN logs for unauthorized sessions.