Ransomware gangs are still using a Palo Alto firewall flaw, patched in May, to sneak past multi-factor login and get into company networks.
Palo Alto Networks says ransomware gangs are still attacking a flaw it fixed in May 2026. The flaw lets attackers skip the extra login check on its firewalls and open VPN connections they should not have. Two groups, known as Qilin and INC, are named. Any company that has not installed the fix is still exposed.
The flaw is tracked as CVE-2026-0257 and scores 7.8 out of 10 for severity. It affects PAN-OS, the software on Palo Alto firewalls, and Prisma Access, its cloud network security service. It is an authentication bypass, meaning it lets someone get past a login check. The U.S. cyber agency CISA added it to its list of known exploited flaws on May 13, 2026.
Palo Alto's Unit 42 research team said Qilin (which it calls Spikey Scorpius) and INC (Tarnished Scorpius) are both using it. Security firm ReliaQuest recently reported seeing Qilin and another group, Settra, doing the same. Arctic Wolf first flagged Qilin using the flaw in July 2026.
Multi-factor authentication, the code or approval step after a password, is meant to stop stolen logins. Here, attackers use the flaw to get a foothold and then get around that step to start a VPN session. A VPN is the private tunnel employees use to reach company systems, so a fake session looks like a trusted user.
Unit 42 says the most striking change is what happens next. Attackers move straight to the virtualization layer, the software that runs a company's servers as virtual machines. In one case they went from the VPN gateway to a management tool called vCenter and turned off a security setting on the host machines. They then pulled passwords straight from a domain controller's virtual disk. That approach sidesteps security software running inside the servers.
Attackers have also gone after Veeam backup systems using an older flaw, CVE-2023-27532. That can wreck a company's ability to recover without paying. Qilin's attacks have ranged from quick encryption-only jobs to double extortion, where data is stolen and threatened with release.
Organizations that run Palo Alto firewalls or Prisma Access and have not applied the update are the main targets. The attacks have hit many sectors, including education, financial services, healthcare, manufacturing, legal services, government, retail, and utilities and energy.
Businesses that do not use these Palo Alto products are not exposed to this particular flaw. Those that patched long ago are in better shape, though Palo Alto still advises hunting for signs of a break-in.
The alert box above lists the steps. The short version is to confirm the fix is installed, then check VPN activity for anything unfamiliar. Palo Alto also recommends looking for signs of compromise and starting incident response if it finds successful gateway-connected events it cannot explain.
Palo Alto says it is continuing to see exploitation, so more reports are likely. The material does not say how many organizations have been hit. Unpatched devices remain the clearest risk.
If your company uses Palo Alto firewalls or Prisma Access, confirm the CVE-2026-0257 fix is installed and check your VPN logs.
Iris Ohyama, the company behind the Iris Plaza online store, says data on up to 7.7 million people may be out. Card numbers were not in the affected service.
Read more: Japanese home goods maker says 7.7 million customers' data may be exposedScammers are emailing Humboldt County well permit applicants and demanding $5,960 before a permit is issued. The county says the fee is fake.
Read more: Fake County Emails Demand $5,960 Fee for Well PermitsCallers posing as the Sheriff's Office told a Sarasota County woman she missed jury duty. She lost over $40,000, and the same scam is hitting others.
Read more: Fake jury duty calls cost one Florida woman over $40,000
