Qilin and INC Ransomware Groups Continue Exploiting Patched Palo Alto Flaw, Now Pivoting Directly to Virtualization Layer (CVE-2026-0257)

Scope: Palo Alto Networks PAN-OS and Prisma Access (patched since May 2026)

Severity: Amber

Palo Alto Networks confirmed this week that ransomware actors Qilin and INC are still actively exploiting CVE-2026-0257, an authentication bypass patched back in May 2026 and added to CISA’s exploited catalog the same month, to set up unauthorised VPN sessions without needing valid credentials and bypassing MFA entirely. What makes this update worth flagging five months after the original patch is the tactical evolution Unit 42 has observed: once inside, these groups are now pivoting directly to the virtualization layer rather than spending time on broader lateral movement first, moving straight to the infrastructure that would let them encrypt the most machines with the least effort. This pattern has been building since Arctic Wolf first flagged Qilin’s exploitation of the same flaw in July, and it confirms that any organisation that did not patch in May remains an active, ongoing ransomware target rather than a theoretical one. Organisations running PAN-OS or Prisma Access that have not yet applied the May 2026 patch must do so immediately and treat it as a confirmed active ransomware entry point rather than a routine update, auditing VPN session logs for connections that do not match known user activity.

The Uganda National CERT and Coordination Center (CERT.UG/CC) encourages users and administrators to review the recommendations and apply the necessary updates.