Palo Alto Networks Warns Qilin and INC Ransomware Exploit PAN-OS Flaw to Bypass MFA

Palo Alto Networks $PANW disclosed on Monday that the Qilin (Spikey Scorpius) and INC (Tarnished Scorpius) ransomware groups are actively exploiting CVE-2026-0257 (7.8 CVSS), an authentication bypass vulnerability in PAN-OS and Prisma Access, to circumvent multi-factor authentication (MFA) and establish unauthorized VPN sessions. Although Palo Alto Networks patched the vulnerability in May 2026 and CISA added it to its Known Exploited Vulnerabilities catalog on May 13, 2026, Unit 42 researchers report ongoing attacks across education, financial services, healthcare, government, manufacturing, utilities, and retail sectors. In one documented intrusion, threat actors pivoted directly from a compromised VPN gateway to a vCenter management appliance, disabled execInstalledOnly security controls on ESXi hypervisors, and used a custom tool to perform offline credential dumping directly against a domain controller's virtual disk (VMDK) to bypass in-guest EDR protections. Attackers have also chained the initial VPN access with remote monitoring and management (RMM) tools for network reconnaissance, lateral movement via RDP and SMB, and exploitation of known Veeam backup vulnerabilities (CVE-2023-27532) prior to ransomware deployment. "The most significant evolution in tactics, techniques and procedures (TTPs) following successful exploitation of CVE-2026-0257 is the direct pivot to the virtualization layer." — Unit 42 Researchers