Qilin and Inc exploit PAN-OS bypass to bypass MFA and deploy ransomware

Palo Alto Networks Unit 42 confirms that ransomware operators including Qilin and Inc are actively exploiting CVE-2026-0257. This high-severity authentication bypass in PAN-OS allows attackers to establish unauthorized VPN sessions while evading multi-factor authentication controls.

What happened

Palo Alto Networks disclosed and patched CVE-2026-0257 on May 13, initially assigning it a medium-severity rating. The vendor stated at that time it was aware of exploitation attempts but had not observed malicious use. Rapid7 researchers later reported successful exploitation in customer environments dating back to May 17.

View the original post on X

Unit 42 announced on Monday that ransomware crews continue to target this vulnerability. Andy Piazza, a senior director of threat intelligence at Unit 42, noted that attackers use the flaw to gain an initial foothold. They subsequently bypass multi-factor authentication to establish a VPN session.

After gaining access, criminals move laterally using Remote Desktop Protocol and Server Message Block. They deploy additional malware for credential harvesting and data theft before installing ransomware. Unit 42 is investigating attacks across numerous industries, including finance, healthcare, and manufacturing.

Why it matters

The ability to bypass multi-factor authentication via a network gateway flaw significantly reduces the barrier for initial access. Attackers do not need stolen credentials to enter the network if the gateway authentication logic is compromised. This shifts the attack surface from user identity to infrastructure configuration.

Unit 42 observes infections in education, financial services, healthcare, high tech, hospitality, and manufacturing. The breadth of affected sectors suggests widespread targeting of Palo Alto Networks GlobalProtect portals and gateways. Organizations relying on these devices for remote access face immediate exposure if unpatched.

Our take on the response

• Verify all PAN-OS devices are updated to versions released after May 13.
• Review GlobalProtect connection logs for sessions that bypassed standard MFA prompts.
• Isolate systems showing lateral movement via Remote Desktop Protocol or Server Message Block.
• Monitor for credential harvesting tools and ransomware deployment indicators in internal traffic.

What defenders should look for

Teams usually detect this activity by analyzing VPN gateway logs for authentication successes that lack corresponding multi-factor verification steps. Check whether remote sessions originate from unexpected geographic locations or unusual time windows. Look for immediate post-login lateral movement, specifically Remote Desktop Protocol connections to internal servers. Monitor for sudden increases in Server Message Block traffic, which often precedes credential harvesting. Containment moves typically involve disabling compromised gateway accounts and blocking lateral communication channels.

Background: Lateral movement

Lateral movement is the process where an attacker navigates from one system to another within a network after initial access. They use stolen credentials or unpatched vulnerabilities to expand their reach. This tactic allows them to reach sensitive data or critical servers without triggering perimeter alarms, making internal monitoring the primary defense.

Read the full guide: Lateral Movement in Cybersecurity: Definition and Detection

What to do and how to stay safe: Palo Alto Networks

• Audit all Palo Alto Networks firewalls and gateways to confirm they run the patched version released after May 13.
• Enable detailed logging on GlobalProtect portals to capture authentication methods and bypass events for forensic analysis.
• Restrict Remote Desktop Protocol and Server Message Block access to only authorized administrative subnets and users.
• Prepare incident response playbooks for ransomware deployment, focusing on rapid isolation of infected endpoints.

Step-by-step guide: Multi-Factor Authentication Best Practices for Secure Access

General security guidance from the NetSec Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-0257?

It is a high-severity authentication bypass vulnerability in Palo Alto Networks' PAN-OS that affects GlobalProtect portals and gateways.

Which ransomware groups are exploiting this flaw?

Unit 42 identified Qilin and Inc as active users of this vulnerability to gain initial network access.

When was the patch released?

Palo Alto Networks disclosed and patched the bug on May 13, though exploitation was observed as early as May 17.