Ransomware Gangs Exploit Palo Alto VPN Flaw to Sidestep MFA and Reach Virtual Servers

Palo Alto Networks has warned that ransomware operators are continuing to exploit CVE-2026-0257, an authentication bypass flaw in PAN-OS and Prisma Access, even though a patch was released in May 2026. The flaw has a CVSS score of 7.8 and can be used to set up unauthorised VPN connections. The U.S. Cybersecurity and Infrastructure Security Agency added it to its Known Exploited Vulnerabilities catalog on May 13, 2026.

Palo Alto's Unit 42 researchers named the Qilin and INC ransomware groups among those exploiting the flaw. Separately, ReliaQuest reported seeing Qilin and Settra actively exploiting it in financially motivated attacks. According to Unit 42, attackers use the flaw to gain an initial foothold in a corporate network, then bypass multi-factor authentication (MFA) to establish a VPN session. Targeted sectors include education, financial services, healthcare, manufacturing, professional and legal services, government, retail and more.

Unit 42 said the most significant change in tactics is a direct move to the virtualisation layer. In one case, attackers went from the compromised VPN gateway to a vCenter management appliance, disabled security controls on ESXi hypervisors, and used a custom tool to pull credentials from a domain controller's virtual disk. This avoids endpoint detection tools running inside the guest systems. Attackers have also targeted Veeam backup infrastructure by abusing a known flaw, CVE-2023-27532, to maximise damage.