Back Ground.News

CISA Gives Feds 3 Days to Patch Check Point VPN Bug Exploited as Zero

Ground.News • June 9, 2026

Check Point said hackers broke into dozens of organizations by exploiting a VPN bug in several of its products used across the government.

CISA has ordered U.S. government agencies to secure their Check Point Remote Access VPN and Mobile Access deployments against a critical vulnerability exploited in zero-day attacks by Qilin ransomware affiliates.

CISA response to an actively exploited VPN bug CISA directed US federal agencies to fix a VPN vulnerability within three days after a ransomware gang began exploiting it. The issue affected security tools used across the federal government, meaning the operational blast radius could be broad if…

A command injection vulnerability (CVE-2026-42271) in BerryAI’s LiteLLM open-source AI gateway is being exploited by attackers.

Threat actors are actively exploiting a critical chained vulnerability in LiteLLM, a popular open-source AI gateway proxy, allowing unauthenticated remote code execution (RCE) on vulnerable deployments. Researchers at Horizon3.ai confirmed that combining two CVEs creates a CVSS 10.0 Critical attack path requiring zero credentials. At the core of this threat is CVE-2026-42271, a command injection flaw in LiteLLM’s Model Context Protocol (MCP) ser…

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added a high-severity flaw impacting BerriAI LiteLLM to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The vulnerability, tracked as CVE-2026-42271 (CVSS score: 8.7), is a command injection vulnerability that could allow any authenticated user to run arbitrary commands on the

To view factuality data please Upgrade to Premium

To view ownership data please Upgrade to Vantage

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

CISA Issues Urgent Directive to Patch Check Point VPN Vulnerability Exploited by Ransomware CISA has mandated federal agencies to patch a critical vulnerability in Check Point VPN products within 72 hours due to active exploitation by the Qilin ransomware group. The vulnerability, tracked as CVE-2026-42271, was first disclosed on May 8, 2026, and has been exploited since May 7, affecting numerous organizations across the U.S. government. Check Point confirmed that dozens of organizations have already been compromised. The urgency of CISA's directive reflects the immediate threat to critical infrastructure, as ransomware gangs increasingly target VPNs. Agencies must either patch the flaw or disconnect affected systems from their networks by June 12, 2026. This incident highlights the growing trend of rapid exploitation of vulnerabilities in widely used security tools. 5 sources 76

Extracted Entities

CISA Gives Feds 3 Days to Patch Check Point VPN Bug Exploited as Zero

The full story

Extracted Entities

Attack Types (2)

CVEs (1)

CWE Weaknesses (1)

Domains (1)

Industries (1)

MITRE ATT&CK (1)

Platforms (2)

Ransomware Groups (1)

Tools (1)