Qilin and INC ransomware exploit Palo Alto authentication bypass to set up VPN sessions and skip MFA

Palo Alto Networks reports continuing exploitation of CVE-2026-0257, an authentication bypass rated 7.8 in PAN-OS and Prisma Access that lets attackers set up unauthorized VPN connections and bypass MFA. Unit 42 attributes the activity to the ransomware operators Qilin and INC, with ReliaQuest also naming Settra. After establishing a VPN session, attackers run reconnaissance with dual-use RMM tools, move laterally over RDP and SMB, and in one case pivoted to vCenter, disabled ESXi security controls, and dumped credentials from a domain controller VMDK, chaining Veeam flaw CVE-2023-27532. The flaw was patched in May and is on CISA's catalog, so apply the latest fixes.

Check

Confirm PAN-OS and Prisma Access carry the May fix for CVE-2026-0257, review VPN logs for unauthorized sessions, and hunt for RMM tools and lateral movement.

Affected

Unpatched PAN-OS and Prisma Access let attackers bypass authentication to open VPN sessions and skip MFA, a foothold ransomware groups use for lateral movement and encryption.

Fix

Apply the latest Palo Alto fixes, enforce MFA at additional layers, watch vCenter and ESXi for tampering, and patch the chained Veeam flaw CVE-2023-27532.