cyber.hendryadrian.com
Vulnerability & Exploit · bleepingcomputer.com

CISA Orders Federal Agencies to Patch Check Point VPN Zero-Day Linked to Qilin Attacks

· Original article ↗

Summary

CISA ordered U.S. federal agencies to address CVE-2026-50751 by June 11 after Check Point reported zero-day exploitation of vulnerable IKEv1 VPN configurations, including one case with confirmed post-compromise activity associated with a Qilin affiliate.

Key points

  • CVE-2026-50751 allows unauthenticated attackers to bypass authentication and establish a remote VPN connection.
  • The flaw affects certain Check Point Mobile Access, SSL VPN, Remote Access VPN, and Spark firewall deployments.
  • Affected deployments use deprecated IKEv1 and legacy remote-access settings, including gateways that do not require machine certificates.
  • Check Point said exploitation began May 7 and increased over the weekend; it reported attacks against a few dozen organizations worldwide.
  • Check Point linked one case to confirmed post-compromise activity associated with a Qilin ransomware affiliate.
  • Check Point released fixes and recommended mitigations for organizations unable to patch, including disabling legacy client support and requiring IKEv2 and machine-certificate authentication.
  • CISA added the flaw to its KEV Catalog and ordered federal agencies to secure affected devices by June 11.

Article Details

Vulnerability Types
  • Unauthenticated VPN authentication bypass
Severity
Critical
Exploitation Status
active
Exploit Availability
unknown
Patch Status
available
Workarounds
  • Remove support for the legacy remote access client.
  • Configure Remote Access VPN Authentication to use IKEv2 only.
  • Enable IPS and download the signatures.
  • Make Machine Certificate Authentication mandatory.

MITRE ATT&CK

T1133 · External Remote ServicesSuccessful exploitation enabled attackers to establish a remote access VPN connection.T1190 · Exploit Public-Facing ApplicationAttackers exploited CVE-2026-50751 against Check Point VPN deployments to bypass authentication.

CVE

CVE-2026-50751checkpoint · Quantum Security Gateway; checkpoint · Spark Firewallsfederal agencies to patch Check Point Remote Access VPN and Mobile Access deployments after a critical zero-day vulnerability, CVE-2026-50751, was exploited in attacks linked to Qilin ransomware affiliates.

Threat Actors

QilinCheck Point linked at least one incident involving exploitation of the vulnerability to post-compromise activity associated with a Qilin ransomware affiliate.

Malware

Qilinfederal agencies to patch Check Point Remote Access VPN and Mobile Access deployments after a critical zero-day vulnerability, CVE-2026-50751, was exploited in attacks linked to Qilin ransomware affiliates.

Vendors

Check Pointfederal agencies to patch Check Point Remote Access VPN and Mobile Access deployments after a critical zero-day vulnerability, CVE-2026-50751, was exploited in attacks linked to Qilin ransomware affiliates.

Products

Mobile Accessfederal agencies to patch Check Point Remote Access VPN and Mobile Access deployments after a critical zero-day vulnerability, CVE-2026-50751, was exploited in attacks linked to Qilin ransomware affiliates.Remote Access VPNfederal agencies to patch Check Point Remote Access VPN and Mobile Access deployments after a critical zero-day vulnerability, CVE-2026-50751, was exploited in attacks linked to Qilin ransomware affiliates.Spark FirewallThe flaw impacts certain Check Point Mobile Access, SSL VPN, Remote Access VPN, and Spark firewalls.SSL VPNThe flaw impacts certain Check Point Mobile Access, SSL VPN, Remote Access VPN, and Spark firewalls.

Countries

United StatesCISA has ordered U.S.

Industries

Governmentgovernment agencies to secure their Check Point Remote Access VPN and Mobile Access deployments against a critical vulnerability exploited in zero-day attacks by Qilin ransomware affiliates.

Related Articles