CISA Issues Urgent Directive to Patch Check Point VPN Vulnerability Exploited by Ransomware

Techcrunch

CISA Issues Urgent Directive to Patch Check Point VPN Vulnerability Exploited by Ransomware

First seen 9 Jun 2026, 20:20 UTC • •75.8

Article Content

1 / 9

Browse articles

ThreatCluster •June 10, 2026 at 20:17 UTC

•CISA ordered federal agencies to patch a critical VPN vulnerability within 72 hours.
•The vulnerability, CVE-2026-42271, is actively exploited by the Qilin ransomware group.
•Dozens of organizations have already been compromised due to this security flaw.

CISA has mandated federal agencies to patch a critical vulnerability in Check Point VPN products within 72 hours due to active exploitation by the Qilin ransomware group. The vulnerability, tracked as CVE-2026-42271, was first disclosed on May 8, 2026, and has been exploited since May 7, affecting numerous organizations across the U.S. government. Check Point confirmed that dozens of organizations have already been compromised. The urgency of CISA's directive reflects the immediate threat to critical infrastructure, as ransomware gangs increasingly target VPNs. Agencies must either patch the flaw or disconnect affected systems from their networks by June 12, 2026. This incident highlights the growing trend of rapid exploitation of vulnerabilities in widely used security tools.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 135d ago How this analysis works

Timeline

2026-05-07

Ransomware attacks begin exploiting VPN vulnerability

Qilin ransomware group starts exploiting a vulnerability in Check Point VPN products, affecting numerous organizations.

2026-05-08

CVE-2026-42271 published

Check Point discloses a critical vulnerability in its VPN products, tracked as CVE-2026-42271.

2026-06-08

CVE-2026-42271 added to CISA KEV catalog

CISA adds CVE-2026-42271 to its Known Exploited Vulnerabilities catalog due to active exploitation.

2026-06-09

CISA issues urgent directive to federal agencies

CISA orders federal agencies to remediate the VPN vulnerability by June 12, 2026, or disconnect affected systems.

More articles in this cluster (8)

Threat Graph

11 entities, 17 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (3)

Ransomware
Zero-day Exploit
T1190 - Exploit Public-Facing Application

Organization (5)

Check Point
Check Point Software
Department of Homeland Security
U.S. Department Of State
U.S. Treasury

Vulnerability (1)

CVE-2026-42271

Threat Actor (2)

Qilin
Qilin Ransomware

Relationships

Qilin uses Ransomware
Qilin uses Zero-day Exploit
Qilin uses T1190 - Exploit Public-Facing Application
Qilin Ransomware uses Ransomware
Qilin Ransomware uses Zero-day Exploit
Qilin Ransomware uses T1190 - Exploit Public-Facing Application
Qilin exploits CVE-2026-42271
Qilin Ransomware exploits CVE-2026-42271
Qilin targets Check Point
Qilin targets Check Point Software
Qilin targets Department of Homeland Security
Qilin targets U.S. Department Of State
Qilin Ransomware targets Check Point
Qilin Ransomware targets Check Point Software
Qilin Ransomware targets Department of Homeland Security
Qilin Ransomware targets U.S. Department Of State
Qilin related to U.S. Treasury

Following this threat?

Track Qilin, Check Point and CVE-2026-42271 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

Hackers Exploit Firewalls, Compromise 70,000 Credentials Globally A large-scale cyber campaign has targeted exposed network edge devices, specifically Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls, leading to the compromise of over 70,000 credentials. The threat actor, known as k0t, has been active since October 2025 and is linked to ransomware groups like Qilin…

Ransomware Groups Exploit PAN-OS Flaw, Target Critical Infrastructure Ransomware groups, including Qilin and INC, are exploiting a critical authentication bypass vulnerability (CVE-2026-0257) in Palo Alto Networks' PAN-OS GlobalProtect and Prisma Access. This flaw allows attackers to establish unauthorized VPN sessions, bypassing multifactor authentication controls. Since its disclosure…