What We Know
The Qilin and INC ransomware groups are exploiting a Palo Alto Networks PAN-OS vulnerability, CVE-2026-0257, to bypass multifactor authentication through GlobalProtect VPN infrastructure.3Backed by 3 sourcesThe Hacker Newsaviatrix.aistartwithidentity.com
The vulnerability was patched by Palo Alto Networks in May, but attackers are still using unpatched or otherwise exposed systems to establish VPN sessions inside targeted networks.2Backed by 2 sourcesmedrisk.iostartwithidentity.com Reporting on the attacks describes follow-on activity including access to internal environments and, in some cases, attempts to dump domain-controller disks, increasing the risk that an initial VPN compromise could lead to broader ransomware deployment.1Backed by 1 sourcesstartwithidentity.com
Unit 42 reported continued attempted exploitation in an October 20 update, while separate reporting dated the ransomware activity to June.3Context supported by 3 independent sourcesunit42.paloaltonetworks.comhelpnetsecurity.comThe Register The activity included use of a patched GlobalProtect authentication bypass to establish VPN tunnels and attempts to dump domain-controller disks.1Context from one sourcescyscan.com
Source Comparison
Aligned reportingCorroborates
- The Hacker News↗The headline directly supports the briefing’s central account that Qilin and INC are exploiting a Palo Alto Networks flaw to bypass MFA.
- aviatrix.ai↗The report identifies Qilin and INC as exploiting a PAN-OS VPN flaw to bypass MFA and describes follow-on activity involving internal access and domain-controller disks.
- medrisk.io↗The report states that Qilin and INC continued using an authentication bypass after Palo Alto fixed the flaw in May to establish VPN tunnels inside clinical networks.
- startwithidentity.com↗The excerpt connects Qilin and INC to a GlobalProtect MFA bypass and describes opening VPN sessions and dumping domain-controller disks after the May fix.
Adds context
- unit42.paloaltonetworks.com↗The Unit 42 brief provides the October 20 reporting point, stating that attempted exploitation of CVE-2026-0257 was continuing.
- scyscan.com↗The excerpt adds that Palo Alto Networks was continuing to observe exploitation of a flaw that had already been patched.
- helpnetsecurity.com↗The report supplies the additional timing detail that ransomware groups had been exploiting the GlobalProtect flaw since June.
- The Register↗The report adds that Unit 42 was investigating network compromises associated with multiple ransomware groups attacking Palo Alto’s firewall operating system since June.