Palo Alto Networks has disclosed that ransomware actors are continuing to exploit a previously patched vulnerability in PAN-OS and Prisma Access. The flaw, tracked as CVE-2026-0257, is described as an authentication bypass issue that could allow attackers to establish unauthorised VPN connections, effectively bypassing multi-factor authentication in affected environments.

The company said the vulnerability was patched in May 2026, but threat activity is still being observed. Reported attribution includes the Qilin and INC ransomware groups, which makes the issue particularly relevant for organisations that rely on Palo Alto infrastructure for secure remote access.

What happened

According to Palo Alto Networks, attackers are exploiting CVE-2026-0257 against systems running affected versions of PAN-OS and Prisma Access. The vulnerability carries a CVSS score of 7.8 and affects authentication controls used for VPN access.

In practical terms, this means an attacker may be able to gain remote network access without completing the normal authentication process. Because VPN gateways sit at the edge of the corporate network, a weakness at this layer can provide a valuable entry point for ransomware operators.

The key detail for businesses is that this is not a newly discovered flaw without a fix. A patch has been available since May 2026. The current risk is tied to organisations that have not yet updated exposed systems or have not fully validated their remote access security posture after patching.

Why it matters for European businesses

For many European SMEs and mid-sized organisations, VPN and cloud-delivered network access remain core parts of daily operations. If an attacker can bypass authentication on these systems, they may gain a foothold that can lead to lateral movement, data theft, service disruption or ransomware deployment.

This matters beyond IT teams alone. Remote access infrastructure often supports employees, contractors, managed service providers and distributed offices. A compromise can therefore affect operations, customer service, internal systems and regulatory exposure, particularly where personal data or sensitive business information is accessible from the network.

The incident also highlights a broader security lesson: MFA does not eliminate risk if the underlying authentication workflow can be bypassed. Businesses should treat internet-facing security appliances and identity-linked infrastructure as high-priority patching assets.

For regulated organisations in Europe, a compromise involving remote access systems may also trigger internal incident response, contractual notification obligations or regulatory assessment depending on the impact. The exact obligations will depend on the sector, the affected data and the organisation's legal environment.

Who may be affected

• Businesses using Palo Alto Networks firewalls or Prisma Access for VPN and remote connectivity
• SMEs with lean IT teams that may have slower patch management cycles for network appliances
• Companies with hybrid or remote work models that depend heavily on VPN access
• Managed service providers and digital agencies that administer customer firewalls and remote access platforms
• Regulated sectors where unauthorised network access could create data protection, resilience or audit issues

What companies should consider

• Confirm patch status immediately for PAN-OS and Prisma Access environments, especially internet-facing VPN services
• Review vendor guidance for the affected vulnerability and verify that all recommended updates and mitigations have been applied correctly
• Check logs and authentication activity for unusual VPN connections, unexpected account behaviour or signs of unauthorised access
• Prioritise edge devices in patch management, including firewalls, VPN gateways and identity-connected appliances
• Validate incident response readiness in case compromised remote access was used as an entry point for ransomware activity
• Review third-party administration paths if external IT providers or partners manage network security infrastructure on the company’s behalf

For European businesses, the immediate takeaway is straightforward: a patched vulnerability on a perimeter system can remain a live ransomware risk for months if updates are delayed. Organisations using affected Palo Alto products should treat verification, monitoring and patch assurance as urgent operational tasks.