Ransomware Operators Continue Exploiting Patched Palo Alto Networks Authentication Bypass
Palo Alto Networks reported that ransomware actors are still exploiting a patched flaw affecting PAN-OS and Prisma Access. The vulnerability, CVE-2026-0257 with a CVSS score of 7.8, is an authentication bypass that can be used to establish unauthorized VPN connections. The company patched the issue in May 2026.
Palo Alto Networks says ransomware groups are continuing to target a security weakness that the company already fixed. The issue affects PAN-OS and Prisma Access and is tracked as CVE-2026-0257, with a CVSS rating of 7.8.
The flaw allows an attacker to bypass authentication and set up VPN connections without authorization. Palo Alto Networks released a patch in May 2026, but the reported ongoing exploitation shows that systems can remain at risk when updates are not applied.
Organizations using PAN-OS or Prisma Access could face unauthorized VPN access if the flaw is exploited, potentially exposing internal systems and sensitive data. Ransomware operators may use such access to escalate attacks, disrupt services, or pressure victims. The impact may extend to employees, customers, and partners whose information or services depend on affected networks. Because a fix exists, the risk may be lower for those who have applied it promptly, though continued exploitation suggests that delayed patching could leave some entities exposed.