Check Point VPN flaw exploited to log in without passwords, Qilin affiliate linked

Check Point on June 8, 2026, released hotfixes for an actively exploited flaw that lets attackers open a remote access VPN session on its security gateways without a valid password. The bug, CVE-2026-50751, affects Remote Access and Mobile Access deployments that still use the deprecated IKEv1 key exchange protocol.

VPN logins are a primary way ransomware groups get inside networks. Check Point said one case it investigated involved follow-on activity linked to an affiliate of the Qilin ransomware operation.

What happened

In a blog post, Check Point said its researchers saw exploitation limited to a few dozen targeted organizations worldwide. The earliest activity dated to May 7, and attempts increased in early June. The flaw, rated 9.3, is a logic weakness in certificate validation for IKEv1. It gets an attacker a VPN session, but further steps are needed to reach internal resources or escalate privileges.

Check Point also disclosed a second IKEv1 issue, CVE-2026-50752, a certificate validation flaw rated 7.4 that could enable man-in-the-middle attacks on site-to-site VPNs under specific conditions. It has not been seen exploited.

CISA added CVE-2026-50751 to its Known Exploited Vulnerabilities catalogue on June 8 and lists it as used in ransomware campaigns. The Canadian Centre for Cyber Security published advisory AV26-559 the same day.

IKEv1 is an older protocol that most vendors have long recommended replacing with IKEv2. Gateways that kept it enabled for compatibility with legacy clients are the ones at risk. Check Point said it added further malicious IP addresses to its indicator list on June 9, 10 and 11.

Affected versions

Affected releases include R80.20.X, R80.40, R81, R81.10, R81.10.X, R81.20, R82, R82.00.X and R82.10. Some of these are already end of support. CVE-2026-50751 affects Mobile Access and SSL VPN, Remote Access VPN and Spark firewalls.

What to do

• Find out whether IKEv1 is enabled for remote access or mobile access, and prioritize those gateways.
• Apply the hotfix described in Check Point's support article sk185033, or use the alternative configuration mitigations listed there if you cannot patch right away.
• Patch CVE-2026-50752 as well, using sk185035.
• Review logs and configurations from May 7 onward and hunt for the IP addresses and file hashes Check Point published.