Ransomware Groups Exploit PAN-OS Flaw, Target Critical Infrastructure

• •Qilin and INC ransomware groups exploit CVE-2026-0257, a high-severity PAN-OS flaw.
• •Over 600 organizations have been targeted, affecting critical infrastructure sectors.
• •Immediate patching and monitoring are essential to mitigate risks from ongoing exploitation.

Ransomware groups, including Qilin and INC, are exploiting a critical authentication bypass vulnerability (CVE-2026-0257) in Palo Alto Networks' PAN-OS GlobalProtect and Prisma Access. This flaw allows attackers to establish unauthorized VPN sessions, bypassing multifactor authentication controls. Since its disclosure on May 13, 2026, the vulnerability has been actively exploited, leading to unauthorized access to corporate networks across various sectors, including education, healthcare, and finance. Reports indicate that over 600 organizations have been affected by ransomware attacks linked to this vulnerability. Security experts recommend immediate patching and monitoring for signs of compromise, as attackers may have already established access before remediation. The situation is compounded by the rise of ransomware-as-a-service (RaaS) operations, which have increased the scale and impact of these attacks.