Qilin and INC abuse PAN-OS flaw for unauthorized VPN access
Palo Alto Networks has warned that the Qilin and INC ransomware groups are exploiting CVE-2026-0257, an authentication-bypass vulnerability in PAN-OS and Prisma Access. The flaw, rated CVSS 7.8, can enable unauthorized VPN connections and allow attackers to bypass multi-factor authentication controls.
The company patched the issue in May 2026, and the U.S. Cybersecurity and Infrastructure Security Agency added it to its Known Exploited Vulnerabilities catalog on May 13. Despite the availability of a fix, Palo Alto Networks continues to see ransomware activity tied to the vulnerability.
VPN access becomes the initial foothold
Unit 42 identifies the operators as Spikey Scorpius, also known as Qilin, and Tarnished Scorpius, also known as INC. ReliaQuest had reported days earlier that Qilin and Settra were actively exploiting the weakness in financially motivated attacks.
After exploiting CVE-2026-0257, the attackers establish a VPN session and use that access as an entry point into the corporate environment. Unit 42 said the subsequent activity includes internal reconnaissance with dual-use remote monitoring and management tools, lateral movement through RDP and SMB, and the staging of tools for credential harvesting, data exfiltration and ransomware deployment.
The observed campaigns have affected a broad range of industries: education, financial services, healthcare, high technology, hospitality, manufacturing, professional and legal services, government, transportation and logistics, utilities and energy, and retail.
Attackers pivot from the gateway to virtualization
Unit 42 highlighted a direct move to the virtualization layer as the most significant tactical development after successful exploitation. In one incident, attackers moved from a compromised VPN gateway to the vCenter management appliance.
From vCenter, they disabled the execInstalledOnly security setting on ESXi hypervisors. They then used a custom tool to conduct offline credential dumping against the virtual disk, or VMDK, of a domain controller.
This approach can avoid in-guest endpoint detection and response tooling and other security protections, while giving the attackers access to domain-wide credentials. The groups have also combined the initial access route with other exploit tools, including attempts to target Veeam backup infrastructure through the known CVE-2023-27532 vulnerability.
Patch status is not the only control
Arctic Wolf had already flagged Qilin exploitation of CVE-2026-0257 in July 2026, describing attacks that ranged from rapid encryption-only operations to full double-extortion activity. The latest observations show that VPN gateways, identity controls, virtualization management and backup systems can all fall within the same intrusion path.
Organizations using affected PAN-OS or Prisma Access deployments should apply the latest fixes and actively hunt for indicators of compromise. Palo Alto Networks also recommends starting incident-response procedures when successful suspicious gateway-connected events are detected, because a valid-looking VPN session may be followed by movement into virtualization and backup environments.