Check Point VPN Zero-Day Exploited in Attacks, One Linked to Qilin

Summary

Check Point says CVE-2026-50751, an authentication bypass in VPN certificate validation, has been exploited since May 7, including in at least one attack by a Qilin affiliate. Hotfixes address it and CVE-2026-50752; CISA added the first CVE to KEV.

Key points

• CVE-2026-50751 is a critical authentication bypass in certificate validation for Check Point Remote Access and Mobile Access products using IKEv1.
• The flaw can let remote attackers establish VPN sessions without a valid password.
• Check Point says exploitation began May 7 and has affected a few dozen targeted organizations; it confirmed at least one attack involved a Qilin ransomware affiliate.
• CVE-2026-50752 enables man-in-the-middle attacks on site-to-site VPN connections and has not been exploited in the wild.
• Check Point released hotfixes for both vulnerabilities, along with indicators of compromise and mitigation guidance.
• CISA added CVE-2026-50751 to its KEV catalog and urged federal agencies to patch by June 11.

MITRE ATT&CK

CVE

Threat Actors

Malware

Vendors

Related Articles

• Eyguières Municipality Targeted in Reported Qilin Ransomware Attackledauphine.comQilin
• Acronis Analyzes Qilin Ransomware’s Windows and ESXi Capabilitiesacronis.comQilin
• Europol IOCTA 2026 Warns AI and Anonymised Infrastructure Are Scaling Cybercrimegithub.com/jacobdjwilsonQilin
• Sophos 2026 Active Adversary Report: Identity Failures Dominate Initial Accessgithub.com/jacobdjwilsonQilin
• Symantec Report Tracks Rising Encryptionless Extortion and New Ransomware Actorsgithub.com/jacobdjwilsonQilin