The Cybersecurity and Infrastructure Security Agency (CISA) has given US federal agencies a three-day deadline to patch a critical VPN vulnerability under active exploitation by a ransomware gang. The bug affects several Check Point products widely deployed across government systems.
Check Point disclosed that hackers have already broken into dozens of organizations by exploiting the flaw. The aggressive timeline underscores the severity of the threat and the urgency of the remediation effort.
CISA's directive is unusual in its brevity, reflecting the high-risk nature of the vulnerability. The agency typically allows more time for patching, but ransomware attacks have already caused confirmed breaches.
The exploit allows attackers to gain unauthorized access to secure networks, potentially leading to data exfiltration or system encryption. Government agencies must act swiftly to prevent further compromise.
Security experts warn that failure to patch within the window could leave systems exposed to ransomware demands and operational disruption.