Qilin ransomware

CISA issued an emergency directive for CVE-2026-50751, a critical authentication bypass vulnerability in Check Point Remote Access VPN, after exploitation began in May. Qilin ransomware affiliates exploited the flaw to breach organizations globally, using techniques like Rclone and Tox protocol for data exfiltration and command-and-control. The vulnerability highlights structural flaws in perimeter-dependent security architectures, where compromised security devices inherit trusted authority.

CISA has mandated U.S. government agencies to address a critical vulnerability in Check Point Remote Access VPN and Mobile Access deployments, which is being exploited as a zero-day by Qilin ransomware affiliates. The directive requires agencies to secure these systems within three days to mitigate the risk of exploitation.