CISA gives federal agencies 3 days to patch Check Point VPN zero-day tied to Qilin ransomware

CISA ordered all Federal Civilian Executive Branch agencies to remediate CVE-2026-50751, a critical authentication bypass in Check Point Remote Access VPN, Mobile Access/SSL VPN and Spark gateways, by end of day June 11 — a three-day deadline far shorter than typical Known Exploited Vulnerabilities remediation windows. The flaw, rated CVSS 9.3 and rooted in a certificate-validation logic error in deployments using the deprecated IKEv1 key exchange protocol, lets unauthenticated remote attackers establish VPN sessions without valid credentials.

Check Point released hotfixes on June 8 and linked at least one intrusion to an affiliate of the Qilin ransomware-as-a-service operation; exploitation began May 7, 2026 and surged in early June, with 'a few dozen' organizations compromised globally, per TechCrunch and BleepingComputer. CISA added the bug to its KEV catalog on June 8 alongside LiteLLM RCE flaw CVE-2026-42271, stating that 'this type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks' to federal systems.

Qilin, active since August 2022 with more than 400 claimed victims, is 2026's most prolific ransomware operation; ZeroFox counted 15 new Qilin victims across nine countries between June 2 and June 5 alone.