Summary
A critical zero-day authentication bypass vulnerability in Check Point VPN products, tracked as CVE-2026-50751 (CVSS 9.3), is under active exploitation by threat actors linked to the Qilin ransomware operation. The flaw exists in a logic error within the IKEv1 key exchange process, allowing unauthenticated attackers to establish VPN sessions without valid credentials on deployments configured to use the deprecated IKEv1 protocol.
Check Point traced the earliest exploitation activity back to May 7, 2026, with a significant uptick observed in early June. One confirmed incident of post-compromise activity has been attributed with medium confidence to a Qilin ransomware affiliate. CISA added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog on June 8, and hotfixes have been released.
During the investigation, Check Point also discovered a related vulnerability (CVE-2026-50752) in the same IKEv1 code path that could enable man-in-the-middle attacks, though no exploitation of this second flaw has been observed yet.
Source
Rapid7 — Critical Check Point VPN Zero-Day Exploited in the Wild
Check Point Blog — Hotfix for Vulnerabilities in Deprecated IKEv1 VPN Protocol
SecurityWeek — Check Point VPN Zero-Day Exploited in Qilin Ransomware Attacks
Commentary
VPN appliances continue to be the initial access vector of choice for ransomware operators, and this Check Point zero-day is a textbook example of why. The flaw sat in deprecated IKEv1 code — legacy protocol support that many organizations leave enabled “just in case” even though modern alternatives exist. Attackers knew exactly where to look.
The Qilin connection is particularly concerning. This group has been on a tear in 2026, and having a zero-day VPN bypass in their toolkit elevates the threat significantly. If your Check Point deployment still accepts IKEv1 connections, patching alone isn’t enough — you should be hunting for signs of compromise dating back to early May. The broader lesson: deprecated protocol support is not harmless backward compatibility. It’s attack surface you’re choosing to maintain.