Multiple ransomware groups, including Qilin and Inc, have been exploiting a high-severity authentication bypass bug in Palo Alto Networks’ PAN-OS, with Unit 42 investigating attacks since early June across numerous industries, such as finance, healthcare, and manufacturing. CVE-2026-0257 affects PAN-OS GlobalProtect portals and gateways, potentially allowing attackers to bypass security restrictions and establish an unauthorized VPN connection. The security vendor first disclosed and patched the bug on May 13 and initially assigned it a medium-severity rating, saying it was aware of attempts to exploit it but had not observed any malicious exploitation. That assessment quickly changed, and by the end of the month, Rapid7 researchers said they observed successful exploitation across multiple customer environments dating back to at least May 17. On Monday, Palo Alto Networks’ consulting and incident response biz, Unit 42, said ransomware crews including Qilin and Inc continue to batter the CVE. “Attackers are leveraging this vulnerability to gain an initial foothold into corporate networks, subsequently bypassing multi-factor authentication (MFA) controls to establish a VPN session,” said Andy Piazza, a senior director of threat intelligence at Unit 42. After gaining initial access, the criminals move laterally across the networks using Remote Desktop Protocol and Server Message Block (SMB), dropping additional malware for credential harvesting and data theft before ultimately deploying ransomware, Piazza warned…