Cybersecurity researchers have warned that ransomware groups are continuing to exploit a patched vulnerability in Palo Alto Networks security products to gain access to corporate networks. The attacks involve Qilin and INC, two ransomware operations that have been linked to activity using the flaw to establish unauthorized VPN connections.

The vulnerability, tracked as CVE-2026-0257, carries a CVSS score of 7.8 out of 10. Although Palo Alto Networks released a fix in May 2026, recent investigations show that unpatched or exposed systems can remain attractive targets months after a security update becomes available.

What Is the Palo Alto Networks Vulnerability?

Palo Alto Networks provides network security products used by businesses to protect internet connections, remote access, and internal systems. Its PAN-OS software supports security appliances, while Prisma Access provides cloud-delivered network security.

CVE-2026-0257 is an authentication bypass vulnerability associated with GlobalProtect, Palo Alto Networks’ remote access technology. Under affected conditions, an attacker may exploit the flaw to establish an unauthorized VPN connection without completing the expected authentication process.

A VPN, or virtual private network, creates a protected connection between a remote device and an organization’s network. Businesses commonly use VPNs to let employees access internal resources while working remotely.

When an attacker gains access through a vulnerable VPN gateway, the consequences can extend beyond the gateway itself. The attacker may be able to investigate internal systems, search for credentials, and attempt to move deeper into the network.

How Are Qilin and INC Using the Flaw?

Palo Alto Networks’ Unit 42 threat intelligence team reported that ransomware operators associated with Qilin and INC have been exploiting CVE-2026-0257. The activity has involved attempts to gain an initial foothold in corporate networks and establish VPN sessions while bypassing multi-factor authentication controls.

After gaining access, attackers have been observed carrying out several activities:

• Network reconnaissance: Examining internal systems and identifying valuable devices or services.
• Lateral movement: Moving between connected systems using tools and protocols such as Remote Desktop Protocol (RDP) and Server Message Block (SMB).
• Credential theft: Searching for passwords and other authentication information that could provide broader access.
• Data theft: Collecting sensitive information before deploying ransomware or using stolen data for extortion.
• Ransomware deployment: Attempting to encrypt systems or threaten to publish stolen information.

These steps are not guaranteed to occur in every incident. Attackers may change their methods depending on the network, security controls, and the access they obtain.

Why Is MFA Not Enough to Stop These Attacks?

Multi-factor authentication, commonly called MFA, requires users to prove their identity using more than one verification method. For example, an employee might enter a password and approve a sign-in request through an authentication app.

MFA is an important security measure because it can prevent attackers from logging in with a stolen password alone. However, it cannot compensate for every vulnerability in the software that controls access.

If a security flaw allows an attacker to bypass the normal authentication process, the attacker may be able to establish a connection without completing the expected checks. This is why organizations need both strong identity controls and properly patched remote access infrastructure.

The incident does not mean MFA is ineffective. It demonstrates that authentication protections must work alongside secure software, restricted access, monitoring, and timely patching.

Which Organizations Could Be at Risk?

The reported activity has affected a broad range of sectors, including financial services, healthcare, education, manufacturing, government, hospitality, retail, transportation, and energy.

Organizations using affected Palo Alto Networks deployments should pay particular attention to whether their GlobalProtect management interfaces are exposed in ways that make them reachable from the public internet.

Unit 42 highlighted a recurring configuration issue in which GlobalProtect profiles were mapped to HTTP or HTTPS services on management interfaces. This could unintentionally expose those interfaces on ports such as 4443 and 3879.

The risk therefore depends on more than the product name. The installed software version, configuration, interface exposure, and whether the appropriate fix has been applied all matter.

How Organizations Should Protect Their Networks

Businesses that use Palo Alto Networks products should take the following steps.

1. Confirm the security update is installed

CVE-2026-0257 was patched in May 2026. Administrators should review the official Palo Alto Networks advisory to identify the correct fixed release for their particular product and deployment. Do not assume that a system is protected simply because it has received other recent updates.

2. Review management interface exposure

Check whether management interfaces are accessible from the public internet. Follow the vendor’s guidance to restrict access to trusted administrative networks and prevent unnecessary exposure of management services.

3. Investigate suspicious VPN sessions

Review VPN authentication and connection logs for unexpected sessions, unusual source locations, unfamiliar accounts, and access that does not match normal user activity. Investigate suspicious successful connections as well as repeated failed attempts.

4. Search for activity after initial access

Security teams should check for unusual remote administration tools, unexpected RDP or SMB connections, suspicious credential access, and unusual activity involving virtualization or backup infrastructure.

5. Prepare for possible ransomware activity

Maintain protected backups, test recovery procedures, and ensure that critical systems cannot be easily accessed using the same credentials as ordinary workstations. If a compromise is suspected, isolate affected systems where appropriate and activate the organization’s incident response plan.

Patching remains essential, but organizations should also investigate whether an attacker gained access before the update was installed.

A Wider Warning for Enterprise Security

This incident shows how a vulnerability in a network gateway can become the starting point for a much larger attack. Remote access systems sit at an important boundary between employees and internal resources. If attackers bypass that boundary, they may attempt to exploit trust relationships and weaknesses elsewhere in the environment.

The reported movement toward virtualization and backup infrastructure is particularly concerning. These systems can hold sensitive credentials, manage many virtual machines, or control the recovery of business data. Compromising them may make an attack harder to contain and recovery more difficult.

For security teams, the lesson is to investigate the full attack path rather than treating a vulnerable gateway as an isolated problem.

Final Thoughts

The continued exploitation of CVE-2026-0257 by ransomware operators associated with Qilin and INC demonstrates why security updates cannot be postponed. A vulnerability patched months ago can still create risk when affected systems remain unpatched or their management interfaces are exposed.

Organizations should verify their software versions, review remote access configurations, investigate suspicious VPN activity, and strengthen protections for credentials, virtualization platforms, and backups.

MFA remains an important defence, but it works best as part of a broader security strategy that also includes patch management, restricted administrative access, monitoring, and tested recovery plans.