CISA gives feds 3 days to patch Check Point VPN bug exploited as zero-day
Source Bleeping Computer
Mentioned vulnerabilities
Rated by Threat Radar
Data as of 9 Jun 2026, 11:54 UTC
What to do
AI-suggested
A security update addressing CVE-2026-50751 has been released by Check Point and should be applied immediately. For environments unable to patch promptly, Check Point recommends removing support for legacy remote access clients, configuring VPN authentication to use IKEv2 only, enabling IPS with updated signatures, and enforcing mandatory machine certificate authentication. U.S. federal agencies must comply with CISA's Binding Operational Directive 22-01 by June 11, 2026. Organizations should follow vendor instructions for mitigation or discontinue use if mitigations are unavailable.
Description
CISA has ordered U.S.government agencies to secure their Check Point Remote Access VPN and Mobile Access deployments against a critical vulnerability exploited in zero-day attacks by Qilin ransomware affiliates. [...]