Check Point VPN Zero-Day Exploited Since Early May by Qilin Ransomware

A critical zero-day authentication-bypass in Check Point VPN products (Quantum Spark, CloudGuard Network Security, Quantum Security Gateways) has been actively exploited since early May 2026 and is linked to a Qilin ransomware affiliate; CISA added the flaw to its Known Exploited Vulnerabilities catalog with a 72-hour remediation directive and Check Point published patches and guidance. The report provides impact details, a timeline, recommended immediate mitigations (apply patch, review logs, disable VPN if needed, enable MFA, network segmentation), and indicators of compromise for hunting and incident response.