Check Point Warns of Active Exploitation of IKEv1 VPN Authentication Flaw
Summary
Check Point says attackers are exploiting CVE-2026-50751 to bypass authentication on certain IKEv1 VPN deployments. A separate flaw, CVE-2026-50752, may enable AitM attacks on site-to-site VPNs; no exploitation evidence was reported.
Key points
- Check Point reported active exploitation of CVE-2026-50751, a certificate-validation logic flaw affecting Remote Access VPN and Mobile Access deployments using IKEv1.
- The flaw can let unauthenticated attackers establish VPN sessions without a valid password; additional post-authentication activity is needed to access internal resources or escalate privileges.
- Exploitation requires specific conditions, including IKEv1 and remote or mobile access being enabled, legacy clients being accepted, and machine certificates not being required.
- Check Point said exploitation targeted a few dozen organizations globally, with activity first observed on May 7, 2026.
- In one case, post-exploitation activity was associated with a Qilin ransomware affiliate; Check Point said it had no indication the flaw was broadly available to other threat actors.
- Check Point also disclosed CVE-2026-50752, which may enable adversary-in-the-middle attacks on site-to-site VPN connections; it reported no evidence of real-world exploitation.
Article Details
- Vulnerability Types
- Certificate-validation logic flaw enabling authentication bypass
- Vulnerability that may enable adversary-in-the-middle attacks on site-to-site VPN connections
- Severity
- Critical (CVE-2026-50751, CVSS 9.3); CVSS 7.40 for CVE-2026-50752
- Affected Versions
- Security Gateways R82.10 Jumbo Hotfix Take 19 or below
- Security Gateways R82 Jumbo Hotfix Take 103 or below
- Security Gateways R81.20 Jumbo Hotfix Take 141 or below
- Security Gateways R81.10 (EOS)
- Security Gateways R81 (EOS)
- Security Gateways R80.40 (EOS)
- Spark Firewalls R80.20.X (EOS)
- Spark Firewalls R81.10.X
- Spark Firewalls R82.00.X
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- unknown
MITRE ATT&CK
T1105 · Ingress Tool TransferAttackers were found attempting to download malicious ELF files from actor-controlled infrastructure.T1133 · External Remote ServicesAfter exploiting the flaw, an attacker can establish a remote access VPN session without a valid user password.T1190 · Exploit Public-Facing ApplicationAttackers are actively exploiting CVE-2026-50751 in internet-accessible Check Point VPN deployments to bypass authentication.
CVE
CVE-2026-50751checkpoint · Quantum Security Gateway; checkpoint · Spark FirewallsCheck Point has disclosed active exploitation of CVE-2026-50751, a critical flaw affecting Remote Access VPN and Mobile Access deployments using deprecated IKEv1, allowing unauthenticated attackers to bypassCVE-2026-50752Vendor / Product unavailableglobally and has been linked in one case to a Qilin ransomware affiliate, while a separate issue, CVE-2026-50752, could enable AitM attacks on site-to-site VPN connections.
Threat Actors
Vendors
Products
Mobile Accesshas disclosed active exploitation of CVE-2026-50751, a critical flaw affecting Remote Access VPN and Mobile Access deployments using deprecated IKEv1, allowing unauthenticated attackers to bypass authentication andRemote Access VPNCheck Point has disclosed active exploitation of CVE-2026-50751, a critical flaw affecting Remote Access VPN and Mobile Access deployments using deprecated IKEv1, allowing unauthenticated attackers to bypassSecurity GatewaySecurity Gateways R82.10 Jumbo Hotfix Take 19 or below, R82 Jumbo Hotfix Take 103 or below, R81.20 Jumbo Hotfix Take 141 or below, R81.10 (EOS), R81 (EOS), and R80.40 (EOS)Spark FirewallSpark Firewalls: R80.20.X (EOS), R81.10.X, and R82.00.X