Qilin and INC Ransomware Groups Exploit Palo Alto Networks Flaw to Bypass MFA
Summary: Palo Alto Networks says ransomware operators including Spikey Scorpius (Qilin) and Tarnished Scorpius (INC) are exploiting CVE-2026-0257, a CVSS 7.8 authentication bypass in PAN-OS and Prisma Access that lets attackers set up unauthorized VPN connections and bypass MFA. The flaw was patched in May 2026 and added to CISA's KEV catalog on May 13, 2026, and Unit 42 reports attackers pivoting from compromised VPN gateways to vCenter and ESXi hypervisors, disabling execInstalledOnly and dumping credentials offline from a domain controller's VMDK.
Bottom line: Unit 42's documented case shows attackers reaching a domain controller's virtual disk and pulling domain-wide credentials without tripping in-guest EDR - so a patched VPN gateway is not the end of the exposure if the virtualization layer underneath it is still reachable.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2023-27532CVE-2026-0257
- Related
- Active Exploitation of May 2026 PAN-OS CVE-2026-0257 (Updated October 20) Cyber Risks · Oct 20, 2026CVE-2026-0257: Palo Alto Networks PAN-OS Authentication Bypass Vulnerability Known Exploited Vulnerabilities · May 29, 2026CVE-2023-27532: Veeam Backup & Replication Cloud Connect Missing Authentication for Critical Function Vulnerability Known Exploited Vulnerabilities · Aug 22, 2023