CVE-2026-50751 - Critical Check Point VPN Authentication Bypass Vulnerability

THE THREAT

On June 8th, 2026, Check Point disclosed a critical zero-day vulnerability impacting its Check Point Remote Access VPN and Mobile Access deployments. Exploitation has been observed and "limited to a few dozen targeted organizations globally". One of the observed attacks was linked to a Qilin ransomware affiliate. The vulnerability, tracked as CVE-2026-50751 (CVSS: 9.3) is a logic flow weakness within Remote Access and Mobile Access certificate validation in the deprecated IKEv1 key exchange, which can allow an unauthenticated attacker to bypass user authentication and establish a VPN connection without a valid password.

As exploitation is ongoing, organizations are advised to apply relevant patches as soon as possible. If patching is not immediately possible, Check Point has outlined mitigation steps that can be performed until patches can be applied.

What we're doing about it

• eSentire's Threat Response Unit (TRU) has conducted threat hunts for known Indicators of Compromise (IoC) associated with exploitation
  • Malicious infrastructure associated with exploitation is blocked for eSentire MDR for Network customers, via the eSentire Global Block List
• eSentire Managed Vulnerability Service (MVS) will add the relevant plugins as they become available
• eSentire's TRU team is evaluating detection opportunities and actively tracking this topic for additional details

What you should do about it

• After performing a business impact review, apply the relevant security patches
• If immediate patching is not possible, the following mitigation steps should be performed:
  • Removing support for legacy Remote Access client connections
  • Configuring Global properties for Remote Access VPN Authentication to IKEv2 only
  • Setting the Machine Certificate Authentication as mandatory

Additional information

Along with the disclosure of the vulnerability, Check Point indicated that exploitation has been ongoing since at least May 7th, 2026. They indicate that attacks involved a limited number of organizations globally, and that one instance involved confirmed post-compromise activity associated with an affiliate of Qilin ransomware. Check Point assessed with medium confidence that the actor behind these attacks is financially motivated and is also targeting vulnerabilities associated with other VPN products, such as Palo Alto, Fortinet, and F5.

Check Point states that once access was obtained to target organizations through successful exploitation of CVE-2026-50751, the attackers downloaded malicious ELF files from Command-and-Control (C2) infrastructure. They noted the "attributional overlap" between the identified activity and previously reported attacks targeting vulnerabilities in network appliances by Qilin affiliates.

During their review into CVE-2026-50751, Check Point discovered CVE-2026-50752 (CVSS: 7.4), a weakness found in the certificate validation logic of IKEv1 key exchange, that can allow an unauthenticated attacker positioned as a Man-in-the-Middle (MitM) to bypass certificate validation in VPN site-to-site connections. Successful exploitation of this flaw could allow for the interception or modification of traffic traversing the VPN tunnel. Check Point notes that exploitation of CVE-2026-50752 has not been identified at the time of publication and is addressed in the same security patches.

In response to this disclosure, CISA added CVE-2026-50751 to its Known Exploited Vulnerabilities (KEV) catalog, mandating that Federal Civilian Executive Branch (FCEB) agencies apply relevant patches or mitigation steps by June 11th, 2026, underscoring the urgency of addressing this issue.

References:
[1] https://blog.checkpoint.com/security/check-point-releases-important-hotfix-for-vulnerabilities-in-deprecated-ikev1-vpn-protocol/
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-50751
[3] https://support.checkpoint.com/results/sk/sk185033?_gl=1*1mp6dhw*_gcl_au*NjY4MzA3OTI4LjE3Nzc0NjkyMzQ
[4] https://ctrlaltintel.com/research/Qilin/
[5] https://nvd.nist.gov/vuln/detail/CVE-2026-50752
[6] https://www.cisa.gov/news-events/alerts/2026/06/08/cisa-adds-two-known-exploited-vulnerabilities-catalog