Qilin & INC Ransomware Exploit PAN-OS CVE-2026-0257: How Attackers Bypassed MFA and Owned the Hypervisor
Executive Summary
In mid-2026, ransomware groups Qilin (Spikey Scorpius) and INC (Tarnished Scorpius) began actively exploiting CVE-2026-0257, a CVSS 7.8 authentication bypass flaw in Palo Alto Networks PAN-OS and Prisma Access, to establish unauthorized VPN sessions and circumvent multi-factor authentication controls. After gaining an initial foothold, attackers conducted internal reconnaissance using dual-use RMM tools, moved laterally via RDP and SMB, harvested credentials by targeting vCenter and ESXi hypervisors at the virtualization layer, and deployed ransomware alongside data-exfiltration tooling across sectors including healthcare, financial services, government, and education. Veeam backup infrastructure was also targeted using CVE-2023-27532 to maximize damage and eliminate recovery options.
This campaign underscores an accelerating trend of ransomware operators chaining perimeter authentication bypasses with deep virtualization-layer attacks to defeat endpoint detection, MFA, and backup resilience simultaneously. As CISA KEV listings shorten the window between disclosure and exploitation, organizations relying on gateway-centric security without east-west segmentation and encrypted-traffic visibility face compounding risk.
Why This Matters Now
CVE-2026-0257 was patched in May 2026 yet exploitation continues at scale through October 2026, with at least three ransomware families weaponizing it. Attackers are bypassing MFA at the VPN layer and pivoting directly to hypervisors, rendering traditional endpoint and identity controls ineffective. Any organization running unpatched PAN-OS or Prisma Access with flat east-west network access is at immediate, active risk of double-extortion ransomware.
Attack Path Analysis
Qilin and INC ransomware actors exploited CVE-2026-0257, an authentication bypass flaw in Palo Alto PAN-OS and Prisma Access, to establish unauthorized VPN sessions and circumvent MFA controls, gaining an initial foothold into corporate networks. Post-compromise activity progressed through internal reconnaissance using RMM tools, lateral movement via RDP and SMB, pivoting to the virtualization layer (vCenter and ESXi), offline credential dumping from VMDK files, data staging and exfiltration, and finally ransomware deployment with backup infrastructure destruction via CVE-2023-27532.
Kill Chain Progression
This analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
Threat actors exploited CVE-2026-0257, an authentication bypass vulnerability in PAN-OS and Prisma Access, to establish unauthorized VPN connections without valid credentials. By bypassing MFA controls at the VPN gateway, attackers gained an initial foothold into corporate networks across multiple critical sectors. The Cloud Native Security Fabric (CNSF) with inline enforcement and the Cloud Firewall (ACF) with anomaly detection on inbound VPN session patterns could have flagged or blocked anomalous gateway-connected events before the session was fully established.
Related CVEs
CVE-2023-27532
CVSS 7.5A vulnerability in Veeam Backup and Replication allows unauthenticated attackers to request encrypted credentials and potentially gain access to backup infrastructure hosts, enabling further compromise of backup systems.
Affected Products:
Veeam Backup and Replication – < 12.0.0.1420, < 11.0.1.1261
Exploit Status:
exploited in the wild
MITRE ATT&CK® Techniques
Exploit Public-Facing Application
External Remote Services
Modify Authentication Process
Remote Services: Remote Desktop Protocol
OS Credential Dumping: Security Account Manager
Process Discovery
Data Encrypted for Impact
Exfiltration Over C2 Channel
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Multi-Factor Authentication Implementation
Control ID: Requirement 8.4
NYDFS 23 NYCRR 500 – Multi-Factor Authentication
Control ID: Section 500.12
DORA (Digital Operational Resilience Act) – ICT Risk Management and Network Security Controls
Control ID: Article 9 – ICT Security Policies
CISA Zero Trust Maturity Model (ZTMM) 2.0 – Network Segmentation and Least-Privilege Access Enforcement
Control ID: Network Pillar – Micro-Segmentation
NIS2 Directive – Vulnerability Management and Incident Handling
Control ID: Article 21 – Cybersecurity Risk Management Measures
HIPAA Security Rule – Emergency Access Procedure and Access Control
Control ID: 45 CFR § 164.312(a)(2)(ii)
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Health Care / Life Sciences
Qilin and INC ransomware exploit CVE-2026-0257 to bypass MFA, threatening PHI exfiltration, lateral movement via RDP/SMB, and ESXi credential dumping violating HIPAA.164.312 controls.
Financial Services
Ransomware actors leveraging PAN-OS authentication bypass to establish rogue VPN sessions, enabling credential harvesting and data exfiltration against PCI.4.0 and ZTMM compliance obligations.
Government Administration
CVE-2026-0257 exploitation enabling MFA bypass and vCenter pivot threatens domain-wide credential compromise in government networks, undermining NIST.800-53.AC-6 and ZTMM zero trust segmentation mandates.
Transportation
Logistics and transportation operators face double-extortion ransomware risk via compromised VPN gateways, with lateral RDP/SMB movement and Veeam backup abuse disrupting critical operational continuity.
Sources
- Qilin and INC Ransomware Groups Exploit Palo Alto Networks Flaw to Bypass MFAhttps://thehackernews.com/2026/10/qilin-and-inc-ransomware-groups-exploit.htmlVerified
- CVE-2023-27532 Detail - NVDhttps://nvd.nist.gov/vuln/detail/CVE-2023-27532Verified
- Veeam Security Advisory KB4424 - CVE-2023-27532https://www.veeam.com/kb4424Verified
- CISA Known Exploited Vulnerabilities Cataloghttps://www.cisa.gov/known-exploited-vulnerabilities-catalogVerified
- New Ransomware Group Exploiting Veeam Backup Software Vulnerabilityhttps://thehackernews.com/2024/07/new-ransomware-group-exploiting-veeam.htmlVerified
- Unit 42 - Active Exploitation of PAN-OS Authentication Bypass by Ransomware Actorshttps://unit42.paloaltonetworks.com/active-exploitation-of-pan-os-cve-2026-0257/
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Aviatrix Zero Trust CNSF is directly relevant to this incident because attackers exploited a VPN authentication bypass to move freely through network layers that lacked workload-level segmentation and identity-aware access controls. By enforcing granular east-west policy, controlled egress paths, and identity-scoped routing boundaries, CNSF would likely have constrained attacker reachability across the virtualization layer, backup infrastructure, and external exfiltration targets — meaningfully reducing the blast radius of this multi-stage ransomware campaign.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: Inline enforcement within the CNSF fabric would likely have flagged anomalous inbound VPN session characteristics — such as unexpected source profiles or unusual authentication patterns — reducing the window in which an unauthorized session could progress deeper into the environment without triggering a policy response.
Control: Zero Trust Segmentation
Mitigation: Zero Trust Segmentation enforcing identity-based, least-privilege access policy would likely have constrained a VPN-authenticated session from reaching vCenter or ESXi management interfaces without an explicit, policy-authorized path — reducing the scope of privilege escalation available from a single compromised gateway session.
Control: East-West Traffic Security
Mitigation: East-West Traffic Security enforcing workload-to-workload segmentation policy would likely have restricted unauthorized RDP and SMB flows between non-adjacent network segments — reducing the attacker's ability to traverse freely from the VPN entry point toward domain controllers and backup infrastructure without crossing an enforced policy boundary.
Control: Multicloud Visibility & Control
Mitigation: Centralized traffic observability across the fabric would likely have surfaced abnormal RMM tool usage patterns and unusual internal-to-external communication flows — giving operations teams the visibility needed to identify attacker-controlled channel behavior that would otherwise blend into legitimate administrative traffic.
Control: Egress Security & Policy Enforcement
Mitigation: Egress Security with FQDN filtering and outbound traffic controls would likely have blocked or constrained data transfers destined for unauthorized external endpoints — reducing the attacker's ability to successfully complete exfiltration to attacker-controlled infrastructure outside the environment.
Had prior CNSF controls constrained lateral reachability and restricted VPN-authenticated sessions from freely accessing backup and virtualization infrastructure, the attacker's ability to propagate ransomware broadly and reach Veeam systems for backup destruction would likely have been reduced — meaning the scope of encrypted assets and eliminated recovery options could have been narrower, even if the initial compromise was not prevented.
Impact at a Glance
Affected Business Functions
- VPN Remote Access and Network Perimeter Security
- Identity and Multi-Factor Authentication (MFA) Services
- Backup and Disaster Recovery Infrastructure
- Virtualization and Hypervisor Management (vCenter/ESXi)
Estimated downtime: 18 days
Estimated loss: N/A
Given the breadth of targeted sectors including healthcare, financial services, education, government, and utilities, the data exposure risk is severe and cross-industry. Confirmed attacker capabilities include offline credential dumping from domain controller virtual disks (VMDK), enabling domain-wide credential compromise. Likely exposed data categories include: employee and customer PII, Electronic Health Records (EHR) in healthcare targets, financial transaction records, government citizen service data, operational technology configurations in utilities and energy, and proprietary business intellectual property. Double-extortion tactics employed by Qilin indicate data was exfiltrated prior to encryption, amplifying breach notification obligations under HIPAA, GDPR, and PCI DSS depending on victim sector. Financial loss estimate is set to $0 as no single confirmed victim financial figure is available; actual sector-wide losses are expected to be materially significant given the scale and multi-sector targeting.
Recommended Actions
Key Takeaways & Next Steps
- • Apply CNSF inline enforcement and Cloud Firewall (ACF) anomaly detection at VPN gateway entry points to identify and block authentication bypass attempts exploiting CVE-2026-0257-class flaws before unauthorized sessions are established.
- • Deploy Zero Trust Segmentation with identity-based policies and least-privilege controls to prevent VPN-authenticated sessions from directly accessing virtualization management planes such as vCenter and ESXi without explicit, policy-enforced authorization.
- • Enforce East-West Traffic Security controls to restrict lateral RDP and SMB movement between workload segments, isolating backup infrastructure and domain controllers from general VPN network access zones.
- • Activate Egress Security and Policy Enforcement with FQDN filtering and Inline IPS (Suricata) signature detection on all outbound paths to block data staging and exfiltration transfers to unauthorized external destinations during double-extortion operations.
- • Leverage Multicloud Visibility and Control with centralized traffic observability and baselining to detect anomalous RMM tool usage, unusual automation patterns, and suspicious internal-to-external flows indicative of attacker-controlled command and control infrastructure.
