The U.S. Cybersecurity and Infrastructure Security Agency (CISA) orders federal agencies to address a critical vulnerability in Check Point Remote Access VPN and Mobile Access deployments that is being exploited in ongoing attacks. According to reporting cited by both outlets, the issue is actively used as a zero-day to compromise victims, including organizations across the U.S. government. CISA instructs agencies to patch the affected systems and take mitigation steps within a three-day window.
The exploitation is attributed to ransomware affiliates connected to Qilin, which are described as using the VPN flaw to gain access and then deploy ransomware operations. TechCrunch reports that Check Point said attackers breached dozens of organizations by exploiting the vulnerability in products deployed across government environments. Bleeping Computer similarly describes CISA’s directive as a response to evidence that the vulnerability is under active exploitation.
Both sources frame the action as an urgent federal cybersecurity measure, emphasizing the need for immediate remediation of the vulnerable VPN components to limit further intrusions and potential ransomware impact.
