Check Point has disclosed a critical authentication bypass zero-day (CVE-2026-50751, CVSS 9.3) in its Remote Access VPN, Mobile Access, and Spark Firewall products that has been actively exploited since at least May 7, 2026. The vulnerability allows remote attackers to establish VPN sessions without valid credentials by exploiting a logic flaw in the deprecated IKEv1 key exchange certificate validation process.
The exploitation has been confirmed in attacks by at least one Qilin ransomware affiliate. Check Point assesses with medium confidence that the threat actor behind the exploitation is financially motivated and may also be targeting similar VPN vulnerabilities from Palo Alto, Fortinet, and F5. Activity surrounding the flaw has increased in early June, with a few dozen targeted organizations affected globally. CISA has added CVE-2026-50751 to its Known Exploited Vulnerabilities (KEV) catalog and ordered federal agencies to patch by June 11.
Check Point also identified a second related issue (CVE-2026-50752) in IKEv1 certificate validation that enables man-in-the-middle attacks on site-to-site VPN connections, though this flaw has not been exploited in the wild. Hotfixes are now available for both CVEs, along with indicators of compromise and mitigation guidance.
Source
SecurityWeek · Help Net Security · Rapid7
Commentary
Another week, another VPN zero-day being wielded by ransomware operators. The pattern is unmistakable: Qilin and other ransomware groups have been systematically hunting VPN appliance vulnerabilities as their preferred initial access vector. Palo Alto, Fortinet, Cisco, F5, and now Check Point — if your perimeter VPN appliance hasn’t been zero-dayed yet, it’s probably just a matter of time.
The fact that this flaw sits in a deprecated IKEv1 key exchange makes it even more frustrating. Legacy protocol support is a recurring source of critical vulnerabilities, and organizations still running IKEv1 should treat this as a loud wake-up call to migrate. CISA’s aggressive June 11 deadline reflects the severity — this isn’t a “patch within 30 days” situation.