Ransomware Groups Exploit Patched Palo Alto Networks Flaw to Bypass MFA in Ongoing Attacks

Palo Alto Networks has issued an alert regarding the ongoing exploitation of a previously patched authentication bypass vulnerability, CVE-2026-0257, affecting its PAN-OS and Prisma Access products. Ransomware groups, specifically Qilin (also known as Spikey Scorpius) and INC (Tarnished Scorpius), are actively leveraging this flaw to establish unauthorized VPN connections and bypass multi-factor authentication (MFA) controls. While a patch was released in May 2026 and the vulnerability was added to CISA's Known Exploited Vulnerabilities (KEV) catalog, attackers are still successfully exploiting systems that have not been adequately secured post-patch. This ongoing exploitation is highly significant for several reasons. Firstly, it demonstrates the persistent threat posed by known vulnerabilities, even after a fix is available. Attackers are clearly targeting organizations that may have delayed patching or failed to verify the complete remediation of the vulnerability. Secondly, the bypass of MFA is particularly concerning, as MFA is often considered a strong defense against unauthorized access. Its circumvention by these ransomware groups provides them with a critical foothold into corporate networks, enabling further malicious activities like internal reconnaissance and lateral movement. This directly impacts network security teams, incident responders, and anyone responsible for maintaining secure access to corporate resources. The trend of exploiting known vulnerabilities, even after patches are released, is a well-established pattern in cybersecurity. Threat actors continuously scan for unpatched or improperly configured systems, and the window between patch release and widespread exploitation is often shrinking. This incident also aligns with the broader trend of ransomware groups evolving their tactics to include more sophisticated initial access techniques and MFA bypasses, moving beyond simpler phishing attacks. The increasing use of AI by attackers to craft more effective attacks further exacerbates this challenge, making it harder for traditional defenses to keep pace. In practice, organizations must prioritize not only the timely application of security patches but also a comprehensive verification process to ensure the patch has been effectively deployed and that no lingering vulnerabilities or backdoors remain. Proactive threat hunting for indicators of compromise related to CVE-2026-0257 is crucial. This includes monitoring VPN logs for unusual activity, scrutinizing authentication attempts, and checking for any unauthorized changes to network configurations. Furthermore, organizations should review their incident response plans, specifically focusing on scenarios involving MFA bypass and initial access via network devices. Regular security audits and penetration testing can also help identify and address such weaknesses before they are exploited by malicious actors. The emphasis must shift from merely patching to validating the effectiveness of those patches and actively defending against adversaries who will inevitably attempt to exploit any remaining gaps.