Ransomware groups exploit Palo Alto Networks flaw to bypass authentication

Palo Alto Networks has disclosed that ransomware actors are continuing to exploit a security vulnerability in PAN-OS and Prisma Access software. DataBreaches.net and The Hacker News both report that hackers are using the flaw to bypass multi-factor authentication and establish unauthorized VPN access. [1][2]

The vulnerability is tracked as CVE-2026-0257 and carries a CVSS score of 7.8, according to DataBreaches.net and The Hacker News. CyberSecurityNews reported that hackers are exploiting the Palo Alto VPN flaw to bypass multi-factor authentication and steal credentials from VMware disks. [1][2][3]

DataBreaches.net and The Hacker News both report that the ransomware groups Qilin and INC are involved in exploiting the authentication bypass flaw. Palo Alto Networks stated that the security flaw has now been patched. [1][2]

Palo Alto Networks is an American cybersecurity company headquartered in Santa Clara, California, that provides advanced firewalls and cloud-based security products. As FTMQ Security reported earlier, Palo Alto Networks previously issued patches for a separate high-severity PAN-OS zero-day vulnerability, tracked as CVE-2026-0322, that allowed authenticated code execution on management interfaces. [12][15]