Ransomware Gangs Found a Way Around MFA — Here's What It Means

Emily Davis · 2026-10-20

Palo Alto Networks just confirmed something that should make every security team sit up straight. Two ransomware groups — Qilin and INC — have been actively exploiting a flaw in PAN-OS and Prisma Access. And the kicker? The vulnerability has already been patched. They're still finding ways in. ### What Exactly Is CVE-2026-0257? This one's an authentication bypass flaw. In plain terms, it lets an attacker skip past the login checks that are supposed to keep them out. Palo Alto gave it a CVSS score of 7.8, which puts it firmly in the "high severity" bucket. Once exploited, bad actors can set up unauthorized VPN connections. Think of it like someone finding a side door into your office building that doesn't trigger any alarms — and then using it to come and go as they please. Palo Alto Networks patched the issue back in May 2026. But here's the uncomfortable truth: patching a flaw doesn't automatically fix every system that's exposed to it. ### Why Ransomware Groups Love MFA Bypasses Multi-factor authentication has been one of the strongest defenses we've had. It's the extra lock on the door. So when a flaw lets attackers sidestep it entirely, that's a big deal. Qilin and INC aren't small-time operations. Qilin has been tied to a string of high-profile attacks across healthcare, manufacturing, and education. INC has built a reputation for aggressive double-extortion tactics. They're not opportunists — they're organized. What makes this situation particularly frustrating is the timing. The patch exists. The fix is available. Yet exploitation continues, which tells us something important about how slowly organizations actually apply critical updates. > "A patch sitting in a release note isn't protection. It's a promise you haven't kept yet." ### The Real Problem: Patch Lag Let's be honest about what's happening here. Ransomware crews are counting on the gap between when a fix drops and when companies actually deploy it. That window can stretch for weeks or even months in larger organizations. Some common reasons for the delay: - Change management processes that move slowly - Fear of breaking production systems - Not enough visibility into which assets are actually exposed - Teams stretched thin and juggling too many priorities None of those are unreasonable. But attackers don't care about your internal approval workflow. ### What Should You Do Right Now? If you're running PAN-OS or Prisma Access in your environment, this isn't a "get to it next quarter" situation. Here's a practical starting point: - Verify you've applied the May 2026 patch across every instance - Audit VPN connection logs for anything that looks unauthorized - Check for unusual authentication patterns, especially sessions that bypassed MFA - Limit VPN access to only the users who genuinely need it - Review your incident response plan and make sure it's current The broader lesson goes beyond Palo Alto. Authentication bypass flaws are showing up everywhere, and ransomware groups are getting faster at weaponizing them. Your patch cadence is now a security metric — treat it like one. ### The Bottom Line MFA is still essential. But it's not magic. When a flaw lets attackers walk around it, the only real defense is speed — patching fast, monitoring closely, and assuming that someone out there is already looking for the door you forgot to lock. Qilin and INC have made that clear. The question is whether the rest of us are listening.