Palo Alto Networks Unit 42 says ransomware operators are continuing to exploit CVE-2026-0257, an authentication bypass in the portal and gateway components of PAN-OS and Prisma Access (CVSS 7.8) that lets an attacker set up a VPN connection without valid credentials.