VPN Data Breach and Security Incident Tracker

Check Point describes CVE-2026-50751 as an authentication bypass affecting specified Remote Access VPN and Mobile Access deployments configured to use deprecated IKEv1. An unauthenticated attacker can establish a remote-access VPN connection without a valid user password. Check Point observed exploitation in the wild and recommends forensic review from its earliest observed date of 7th May 2026. CISA added the flaw to its Known Exploited Vulnerabilities catalog on 8th June 2026.

Evidence: Check Point’s official advisory and CISA’s Known Exploited Vulnerabilities catalog.

Ivanti disclosed two critical Sentry flaws. CVE-2026-10520 is an unauthenticated OS-command injection that can provide root-level remote code execution. CVE-2026-10523 is an authentication bypass that can allow creation of arbitrary administrator accounts and full administrative access. Ivanti said it was not aware of customer exploitation at disclosure. Public technical analysis of CVE-2026-10520 was subsequently released, increasing patch urgency, but that does not by itself prove in-the-wild exploitation.

Evidence: Ivanti’s advisory, NVD CVE records, the Canadian Centre for Cyber Security and watchTowr technical analysis.

Cyderes identified an attacker-controlled X‑VPN bundle containing legitimate X‑VPN and WireGuard components alongside a malicious CRYPTBASE.dll. Running the repackaged bundle could trigger DLL sideloading and load STX RAT in memory. Cyderes states that X‑VPN’s service, infrastructure, servers, accounts and official downloads were not breached. It also states that no confirmed in-the-wild exploitation was identified through this X‑VPN-specific path; the malicious bundle and attack capability are confirmed, while the number of victims is unknown.

Evidence: Cyderes Howler Cell’s coordinated disclosure, including X‑VPN’s documented remediation.

Amnezia said an unusually large denial-of-service attack coincided with targeted blocking of many server addresses, causing unstable applications and difficulty switching servers. Meduza reported that Free and Premium users were affected. Amnezia attributed the activity to Roskomnadzor, which did not comment in the cited report. No independent forensic evidence has publicly established the attacker’s identity, and no customer-data exposure has been reported.

Evidence: Amnezia’s statements as reported by Meduza; the attribution remains unverified.

Fortinet said a threat actor exploited previously known vulnerabilities and created a symbolic link between the user and root filesystems in a directory used by the SSL‑VPN interface. This could preserve read-only access to files, including configurations, after the original entry point was patched. Fortinet states that devices which had never enabled SSL‑VPN were not affected by this specific persistence technique.

Evidence: Fortinet PSIRT technical analysis.

Mullvad reported that Swedish police visited its Gothenburg office with a search warrant on 18th April 2023 and intended to seize computers containing customer data. Mullvad said the requested customer information did not exist and that officers left without taking equipment or obtaining customer information. This is a provider-reported legal transparency event, not independent proof that every possible Mullvad data category is absent.

Evidence: Mullvad incident statement and follow-up publication of the Swedish prosecution response.

Windscribe reported that two legacy servers in Ukraine were seized on 24th June 2021. Their unencrypted disks contained an OpenVPN server certificate and private key, but Windscribe said the servers held no VPN traffic logs and it had no reason to believe they were accessed before seizure. The exposed material created a narrow impersonation risk under specific conditions; it did not enable decryption of previously recorded VPN traffic.

Evidence: Windscribe’s detailed incident and remediation post.

CVE-2021-22893 affected Pulse Connect Secure 9.0R3/9.1R1 and later vulnerable releases. Official records describe an authentication-bypass condition involving Pulse features that could allow an unauthenticated attacker to achieve remote arbitrary code execution on the gateway. The vulnerability was exploited in the wild, prompted a CISA emergency directive and remains a benchmark example of why VPN gateways require both rapid patching and integrity checking.

Evidence: Ivanti/Pulse Secure advisory SA44784, NVD and CISA emergency and exploited-vulnerability records.

NordVPN said one rented server in Finland was accessed without authorisation in March 2018 through an insecure remote-management account added by the datacentre. NordVPN said no user credentials or activity logs were affected and no other servers were exposed. The attacker obtained TLS keys that NordVPN said could support only a highly targeted impersonation scenario and could not decrypt NordVPN VPN traffic.

Evidence: NordVPN’s official datacentre-breach response.