CISA Orders Feds to Patch Check Point VPN Zero-Day by June 11

The Cybersecurity and Infrastructure Security Agency directed U.S. federal agencies to protect their Check Point Remote Access VPN and Mobile Access systems from a severe authentication bypass flaw that attackers have used as a zero-day.

CISA adds CVE-2026-50751 to its Known Exploited Vulnerabilities catalog. The agency instructed Federal Civilian Executive Branch entities to implement remedies no later than June 11 in accordance with Binding Operational Directive 22-01. "This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise," CISA stated.

Although the directive targets only federal organizations, CISA called on private-sector security teams to install available fixes for CVE-2026-50751 without delay and to harden their networks.

Check Point discloses the flaw as actively exploited since May 7. The Israeli firm issued patches on Monday and reported that malicious activity targeting the vulnerability started on May 7 before intensifying over the weekend.

The issue, tracked as CVE-2026-50751, permits unauthenticated remote adversaries to evade login requirements and open VPN sessions on affected Mobile Access/SSL VPNs, Remote Access VPNs, or Spark firewalls. It is limited to deployments that rely on the outdated IKEv1 protocol, omit machine certificate checks, and still support older Remote Access clients.

Exploitation linked to Qilin ransomware with limited global impact so far. So far the incidents have compromised only a few dozen entities across the globe. Check Point tied at least one breach to an affiliate of the Qilin Ransomware-as-a-Service program, which has listed more than 400 victims on its leak site after emerging in August 2022. "To date, the observed exploitation has been limited to a few dozen targeted organizations globally. One case involved confirmed post-compromise activity associated with Qilin ransomware affiliate," the company said. It urged administrators still using IKEv1 to install the updates right away.

Workarounds provided for systems that cannot be patched immediately. For environments that cannot be updated at once, Check Point recommended disabling legacy remote access client support, restricting Remote Access VPN Authentication to IKEv2 exclusively, activating IPS with the latest signatures, and requiring Machine Certificate Authentication. CISA echoed the advice to follow vendor guidance, adhere to BOD 22-01 cloud rules, or stop using the affected product when fixes are unavailable.

Check Point VPN flaws previously targeted by ransomware groups. In 2024, CISA cataloged another actively exploited vulnerability in the vendor's Quantum Security Gateways that ransomware operators had leveraged, aligning with an Orange Cyberdefense CERT assessment that connected it to NailaoLocker incidents.