Check Point Patches Exploited VPN Zero-Day Linked to Qilin Affiliate
Summary
Check Point patched CVE-2026-50751, an authentication bypass actively exploited against a few dozen organizations; one case involved confirmed post-compromise activity associated with a Qilin affiliate. CVE-2026-50752 affects IKEv1 certificate validation; no in-the-wild
Key points
- CVE-2026-50751 allows unauthenticated remote attackers to bypass authentication and establish VPN access on affected Check Point deployments.
- The flaw affects deployments using deprecated IKEv1 that accept legacy Remote Access clients and do not require machine-certificate authentication.
- Check Point said exploitation began May 7, surged in early June, and affected a few dozen organizations worldwide.
- At least one case involved confirmed post-compromise activity associated with a Qilin ransomware affiliate.
- Check Point released security updates and advised customers to remove legacy-client support, require IKEv2 and machine-certificate authentication, and enable IPS signatures if they cannot patch immediately.
- CVE-2026-50752 is an IKEv1 certificate-validation flaw that could enable man-in-the-middle attacks on site-to-site VPN connections; Check Point reported no evidence of exploitation.
Article Details
- Vulnerability Types
- Authentication bypass
- IKEv1 certificate validation issue
- Severity
- Critical for CVE-2026-50751; not stated for CVE-2026-50752
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- Remove support for the legacy remote access client.
- Configure Remote Access VPN Authentication to use IKEv2 only.
- Make Machine Certificate Authentication mandatory.
- Enable IPS and download the signatures.
MITRE ATT&CK
T1133 · External Remote ServicesAttackers exploited CVE-2026-50751 to bypass authentication and establish remote access VPN connections.T1557 · Adversary-in-the-MiddleCVE-2026-50752 could enable man-in-the-middle attacks on site-to-site VPN connections; the article reports no evidence of in-the-wild exploitation.
CVE
CVE-2026-50751checkpoint · Quantum Security Gateway; checkpoint · Spark FirewallsCheck Point has patched CVE-2026-50751, a critical authentication bypass flaw in Remote Access VPN and Mobile Access deployments that was actively exploited in zero-day attacks.CVE-2026-50752Vendor / Product unavailableThe company also discovered CVE-2026-50752, a related IKEv1 certificate validation issue that could enable man-in-the-middle attacks on site-to-site VPN connections.
Threat Actors
Vendors
Products
Mobile AccessCheck Point has patched CVE-2026-50751, a critical authentication bypass flaw in Remote Access VPN and Mobile Access deployments that was actively exploited in zero-day attacks.Remote Access VPNCheck Point has patched CVE-2026-50751, a critical authentication bypass flaw in Remote Access VPN and Mobile Access deployments that was actively exploited in zero-day attacks.Spark Firewallattackers to bypass authentication on targeted Mobile Access / SSL VPNs, Remote Access VPNs, or Spark firewalls and establish a remote access VPN connection.