CISA Orders Federal Agencies to Patch Critical VPN Vulnerability Exploited by Ransomware Gang

CISA's new Binding Operational Directive 26-04, announced Wednesday, establishes a tiered remediation framework for Federal Civilian Executive Branch agencies based on four criteria: whether a system is publicly exposed, whether the vulnerability appears in CISA's Known Exploited Vulnerabilities catalog, whether exploitation can be automated, and the degree of access an attacker would gain. As illustrated in CISA's decision-tree diagram, vulnerabilities meeting all four criteria must be fixed within three days and require a forensic triage to check for prior compromise; less severe flaws carry two-week or two-month deadlines. CISA Acting Executive Assistant Director Chris Butera cited advances in AI models — specifically their ability to autonomously find and exploit vulnerabilities at scale — as a key driver, noting that 'defenders cannot afford to take weeks to patch systems that can be autonomously exploited en masse.' The directive supersedes BOD 19-02 and BOD 22-01, which had set 15- and 30-day windows for the most critical bugs. Separately, CISA also invoked the older BOD 22-01 to order agencies to patch CVE-2026-50751, a critical authentication bypass in Check Point Remote Access VPN and Mobile Access products being actively exploited by a Qilin ransomware affiliate since at least May 7, with a remediation deadline of June 11. Check Point released an emergency hotfix on June 8 and disclosed a second related vulnerability, CVE-2026-50752, affecting IKEv1 key exchange configurations, though no in-the-wild exploitation of the second flaw has been reported. Some security experts welcomed the new directive but cautioned that faster patching alone is insufficient without architectural changes to limit attacker access after a breach.