Ransomware Groups Exploit Patched Palo Alto Flaw to Bypass MFA

Ransomware groups including Qilin and INC are actively exploiting a previously patched authentication bypass flaw in PAN-OS and Prisma Access. Tracked as CVE-2026-0257 with a CVSS score of 7.8, the vulnerability allows threat actors to establish unauthorized VPN connections and bypass multi-factor authentication controls. Organizations that have not yet applied the vendor fix face severe risks of network intrusion and ransomware deployment.