CISA gives US federal agencies three days to fix a VPN bug under attack by a ransomware gang

A significant security breach is unfolding as a ransomware group exploits an unaddressed vulnerability in key security software utilized by U.S. federal agencies. In response, the Cybersecurity and Infrastructure Security Agency (CISA) has mandated that all civilian federal agencies address this critical flaw by the end of the day on Wednesday. According to cybersecurity firm Check Point Software, the vulnerability affects numerous remote access tools, firewalls, and VPNs that serve as essential defenses against unauthorized network access. The firm reported that this flaw is being actively leveraged by a notorious ransomware group known as Qilin, which has successfully infiltrated several dozen targeted organizations worldwide that depend on the compromised security measures. The exploitation of this vulnerability began on May 7, with a marked increase in activity observed last week. Recognizing the potential threat to federal enterprise networks, CISA took decisive action on Monday, instructing all civilian federal agencies—including the Department of Homeland Security, the State Department, and the Treasury—to promptly rectify any instances of using the affected software by the June 11 deadline. This directive stems from CISA's operational guidance memo, BOD 22-01, which empowers the agency to enforce security measures in response to active cyber threats against government systems.