Qilin & INC Ransomware Exploit PAN-OS Flaw to Sidestep MFA

Introduction

A significant security alert has emerged from the threat intelligence landscape: two notorious ransomware syndicates, Qilin and INC Ransomware, are actively weaponizing a recently patched vulnerability in Palo Alto Networks' infrastructure. The flaw, tracked as CVE-2026-0257, carries a CVSS score of 7.8 and represents a dangerous authentication bypass that allows attackers to circumvent multi-factor authentication (MFA) entirely. By exploiting this weakness, threat actors can forge unauthorized VPN connections, granting them a foothold inside target networks without ever needing stolen credentials. This development underscores a troubling trend where ransomware groups rapidly operationalize proofs-of-concept for critical perimeter vulnerabilities.

Technical Breakdown of the Authentication Bypass

The vulnerability resides within the PAN-OS operating system powering Palo Alto Networks' next-generation firewalls and the Prisma Access cloud-delivered security service. Specifically, the flaw lies in the authentication logic handling VPN gateway connections. Under certain conditions, the system fails to properly enforce the second factor of authentication during the VPN handshake process. This allows an unauthenticated remote attacker to manipulate the authentication flow, tricking the gateway into granting access based solely on the first factor (typically a username and password) or, in some configurations, no credentials at all.

• Component Affected: GlobalProtect Gateway and Portal interfaces on PAN-OS and Prisma Access.
• Attack Vector: Network-based, remote, requiring no prior authentication.
• Impact: Full bypass of MFA, leading to unauthorized network access equivalent to a legitimate remote user.
• Remediation Status: Patches released in May 2026 for all supported PAN-OS versions (10.2, 11.0, 11.1) and Prisma Access.

The speed with which Qilin and INC Ransomware integrated this exploit into their operations is alarming. Typically, there is a lag between patch availability and widespread exploitation. In this case, telemetry suggests active scanning and exploitation attempts began almost immediately following the public disclosure, targeting organizations that had not yet applied the hotfix.

Threat Actor Profiles: Qilin and INC Ransomware

Understanding the operators behind the keyboard provides context for the severity of this campaign. Both groups operate under the Ransomware-as-a-Service (RaaS) model but exhibit distinct tactical preferences.

Qilin (Agenda)

Qilin, previously known as Agenda, is a Golang-based ransomware strain known for its cross-platform capabilities (Windows and Linux) and heavy customization per victim. The group is highly selective, often targeting healthcare, education, and critical infrastructure. They favor "double extortion" — encrypting data and threatening to leak it on their dedicated leak site. Their affiliation structure is tight-knit, suggesting a high degree of operational security and technical competence among their affiliates.

INC Ransomware

INC Ransomware emerged in 2023 and quickly gained notoriety for aggressive targeting of mid-sized enterprises across North America and Europe. They are known for rapid encryption speeds and a preference for exploiting internet-facing vulnerabilities (such as CitrixBleed and ConnectWise flaws) for initial access. Their ransom notes often mimic legitimate penetration testing reports, a psychological tactic designed to pressure victims into compliance.

Operational Impact: Why MFA Bypass Changes the Game

For years, MFA has been the "gold standard" for securing remote access. VPNs protected by MFA were considered a robust barrier against credential stuffing, phishing, and password spraying. CVE-2026-0257 shatters that assumption for affected Palo Alto deployments. When the authentication protocol itself is flawed, the strength of the second factor becomes irrelevant. The attacker doesn't need to phish a token, SIM-swap a phone number, or compromise an authenticator app; they simply walk through the front door because the lock mechanism is broken.

This shifts the initial access burden significantly. Affiliates no longer need sophisticated social engineering kits. They can automate scanning for vulnerable GlobalProtect portals, run the exploit, and gain a valid session cookie or token instantly. This lowers the barrier to entry for less skilled affiliates within the RaaS ecosystems, potentially leading to a surge in intrusion volume.

Immediate Mitigation Steps for Defenders

While patching is the ultimate fix, defense-in-depth measures are required immediately, especially if patching requires a maintenance window.

• Apply Hotfixes Immediately: Upgrade PAN-OS to versions 10.2.12, 11.0.7, 11.1.2, or later. Prisma Access is updated automatically by Palo Alto Networks, but verify the version status in the Strata Cloud Manager.
• Restrict VPN Access: Limit GlobalProtect portal/gateway access to known corporate IP ranges or geolocations where possible.
• Enable Multi-Factor Authentication Enforcement: Ensure MFA is enforced at the Identity Provider (IdP) level (SAML/RADIUS) rather than relying solely on the firewall's local MFA capabilities, adding a layer of validation the firewall bypass cannot circumvent.
• Monitor for Anomalous VPN Logins: Deploy SIEM rules alerting on: VPN logins from new geolocations/ASNs, multiple failed MFA attempts followed by success, and VPN sessions initiating at odd hours for the user's timezone.
• Certificate-Based Authentication: Migrate from password+MFA to client certificate authentication for GlobalProtect where feasible. This renders credential-based bypasses ineffective.
• Threat Hunt: Search logs for CVE-2026-0257 exploitation indicators (specific HTTP request patterns to the portal/gateway) dating back to early May 2026.

Conclusion

The active exploitation of CVE-2026-0257 by Qilin and INC Ransomware serves as a stark reminder that perimeter security appliances are high-value targets. The ability to bypass MFA — the cornerstone of modern remote access security — transforms a standard vulnerability into a crisis-level event for unpatched organizations. Patching is non-negotiable, but it is merely the baseline. The strategic lesson is clear: implicit trust in any single control, including the VPN gateway itself, is a liability. Organizations must architect resilience through Zero Trust principles, continuous verification, and AI-augmented security operations that can detect and respond to novel exploitation techniques in real-time. Grivyonx Cloud stands ready to assist enterprises in validating their security posture against this specific threat and modernizing their access control frameworks to withstand the next inevitable perimeter breach.