Ransomware attackers exploit Palo Alto VPN flaw to bypass authentication

The flaw allows attackers to bypass multi-factor authentication and gain access to corporate networks. According to The Hacker News, CVE-2026-0257 affects PAN-OS and Prisma Access and was patched in May 2026. Cyber Security News reports that attackers in one investigated case stole credentials from a domain controller’s VMware virtual disk, avoiding security tools inside the virtual machine.

• The Hacker News gives the vulnerability a CVSS score of 7.8.

Covered by 2 publishers within 5 hours of the first report.

• The Hacker News: Qilin and INC Ransomware Groups Exploit Palo Alto Networks Flaw to Bypass MFA

Reporting2

CSN Cyber Security News Hackers Exploit Palo Alto VPN Flaw to Bypass MFA and Steal Credentials From VMware Disks · Guru Baran 6:03 AM

THN The Hacker News Qilin and INC Ransomware Groups Exploit Palo Alto Networks Flaw to Bypass MFA · info@thehackernews.com (The Hacker News) 11:32 AM

Related

DR Prominent Ransomware Negotiator Faces Extortion Charges October 11

REC Japan sends Russian Qilin ransomware suspect to Germany October 9

SW Advantest Discloses Data Breach Months After Ransomware Attack October 7

CS Ransomware recovery CEO indicted after allegedly paying hackers and pocketing millions October 8

Topics Ransomware