Check Point VPN Zero-Day Exploited Since Early May by Qilin Ransomware

Critical Check Point VPN Flaw Under Active Exploitation

A critical zero-day vulnerability in Check Point VPN products has been actively exploited in the wild since at least early May 2026, with security researchers attributing at least one confirmed incident to a Qilin ransomware affiliate.

The flaw, which affects Check Point's Quantum Spark and CloudGuard product lines among others, allows attackers to bypass authentication and gain unauthorized remote access to enterprise networks without valid credentials.

Vulnerability Summary

How the Exploit Works

According to researchers, the vulnerability resides in the VPN authentication flow and allows an unauthenticated remote attacker to bypass credential validation. Successful exploitation grants an attacker the ability to:

• Establish a VPN tunnel as a legitimate user without supplying valid credentials
• Access internal network resources protected behind the VPN gateway
• Conduct lateral movement across the target organization's environment
• Deploy ransomware payloads or exfiltrate sensitive data

The attack requires no user interaction and can be executed remotely, making it particularly dangerous for organizations with internet-facing Check Point VPN gateways.

Qilin Ransomware Connection

Researchers have linked at least one confirmed breach to a Qilin ransomware affiliate exploiting this vulnerability. Qilin (also tracked as Agenda) is a ransomware-as-a-service (RaaS) operation known for targeting critical infrastructure and healthcare organizations.

The group's use of this zero-day demonstrates the increasingly rapid weaponization of newly discovered vulnerabilities by ransomware operators. The exploitation predates public disclosure by several weeks, indicating the flaw was acquired or independently discovered and held for targeted attacks.

Qilin has a history of exploiting VPN and remote access vulnerabilities as initial access vectors, consistent with this latest campaign.

Timeline

• Early May 2026: Earliest confirmed exploitation observed in the wild
• June 2026: Check Point becomes aware of active exploitation
• June 8, 2026: Dark Reading reports on the active exploitation and Qilin attribution
• June 9, 2026: CISA adds the flaw to the Known Exploited Vulnerabilities (KEV) catalog with a 3-day federal remediation deadline
• June 14, 2026: Patch availability and remediation guidance published

CISA Emergency Directive

The Cybersecurity and Infrastructure Security Agency (CISA) added the Check Point VPN vulnerability to its Known Exploited Vulnerabilities (KEV) catalog and issued a Federal Civilian Executive Branch (FCEB) agency directive requiring remediation within 72 hours — one of the shortest deadlines CISA has imposed, reflecting the severity of active exploitation.

Affected Products

Organizations should immediately assess their exposure if running any of the following:

• Check Point Quantum Spark gateways
• Check Point CloudGuard Network Security
• Check Point Quantum Security Gateways running affected software versions
• Any Check Point product with remote access VPN enabled

Immediate Remediation Steps

1. Apply the vendor patch immediately — check the Check Point Security Advisory portal for the latest hotfix
2. Review VPN access logs from May 2026 onward for suspicious authentication patterns, especially:
   • Successful logins from unusual geographic locations
   • Authentication successes without corresponding password attempts
   • Unusual connection times or data volumes
3. Disable remote access VPN temporarily if patching is not immediately possible for critical systems
4. Reset VPN credentials for all users as a precaution
5. Enable MFA on all VPN access points if not already configured
6. Segment the network to limit lateral movement in case of compromise

Indicators of Compromise

Organizations should hunt for the following indicators:

• Unexpected VPN sessions with no corresponding authentication failures
• Internal network scanning activity originating from VPN subnet
• Unusual outbound connections to known Qilin C2 infrastructure
• Ransomware staging tools (e.g., Cobalt Strike, remote access trojans) on systems accessible via VPN

Why This Matters

This incident illustrates several compounding risks in enterprise VPN security:

Prolonged silent exploitation: The gap between exploitation start (early May) and public awareness (June) gave attackers over a month of undetected access in affected organizations. This window is consistent with sophisticated ransomware pre-deployment reconnaissance.

Supply chain of vulnerability intelligence: The Qilin affiliate's rapid use of this zero-day raises questions about how ransomware groups are obtaining access to previously unknown CVEs — whether through independent discovery, underground markets, or nation-state-affiliated brokers.

VPN as primary attack surface: Enterprise VPN gateways continue to be the single most targeted initial access point for ransomware operators due to their internet-facing nature, privileged network position, and historically slow patch adoption.

Recommendations for Security Teams

• Prioritize VPN gateway patching above other maintenance activities until this is resolved
• Conduct a retrospective investigation of VPN logs from May 2026 to present
• Brief executive leadership on potential exposure given the extended pre-disclosure exploitation window
• Consider engaging an incident response firm if forensic investigation capacity is limited internally

References

• Dark Reading — Check Point VPN Flaw Exploited Since Early May
• CISA Known Exploited Vulnerabilities Catalog
• Check Point Security Advisory Portal