Check Point VPN authentication-bypass zero-day exploited in the wild (CVE-2026-50751)

On 8 June 2026, Check Point Software Technologies — the Israeli network-security vendor — disclosed that attackers were actively exploiting a critical authentication-bypass zero-day, tracked as CVE-2026-50751, in its Remote Access VPN and Mobile Access products. The flaw lets an attacker establish a VPN session without a valid password, and Check Point linked at least one confirmed intrusion to a Qilin ransomware affiliate.

What happened

CVE-2026-50751 is an improper-authentication flaw (CWE-287) carrying a CVSS score of 9.3. It affects Remote Access VPN and Mobile Access deployments configured to use the deprecated IKEv1 key-exchange protocol. By abusing a logic flaw in certificate validation, an attacker can bypass the password requirement and authenticate to the VPN gateway as a legitimate remote-access user.

Check Point says the earliest observed exploitation dates back to 7 May 2026, with the company first noticing suspicious activity on 4 June 2026. Exploitation has so far been limited to a few dozen targeted organisations worldwide, but in at least one case the access was followed by post-compromise activity associated with a Qilin ransomware affiliate — turning a VPN foothold into the opening move of a ransomware intrusion.

During its investigation, Check Point identified a second, related issue — CVE-2026-50752 — also tied to certificate validation in the deprecated IKEv1 exchange, which under specific conditions could allow man-in-the-middle interference with site-to-site VPN traffic.

Impact

• A critical (CVSS 9.3) authentication bypass allowing password-less VPN logins on IKEv1-configured gateways.
• Active in-the-wild exploitation observed against several dozen organisations globally.
• At least one intrusion tied to a Qilin ransomware affiliate, raising the prospect of follow-on encryption and extortion.
• Check Point released emergency hotfixes and advised customers unable to patch immediately to drop the legacy remote-access client, restrict authentication to IKEv2 only, and make machine-certificate authentication mandatory.

Why it matters

Edge devices — VPN gateways and firewalls in particular — remain the favourite initial-access vector for ransomware crews, because a single authentication bypass hands an attacker a trusted position inside the network perimeter. The IKEv1 angle is a reminder that deprecated protocols left enabled for backward compatibility are a recurring source of risk: the secure default existed, but legacy configurations kept the vulnerable path alive long enough for attackers to find it.