Critical Check Point VPN Flaw Exploited to Bypass Passwords in IKEv1 Setups
Summary: Check Point warned of active exploitation of CVE-2026-50751 (CVSS 9.3), a certificate-validation logic flaw in Remote Access VPN and Mobile Access deployments using the deprecated IKEv1 protocol that lets an unauthenticated attacker establish a VPN session without a valid password. Check Point said it saw suspicious activity on June 4, 2026, with exploitation dating to May 7, 2026, limited to a few dozen targeted organizations globally, and one post-exploitation case tied to a Qilin ransomware affiliate; CISA added the flaw to its KEV catalog on June 8, 2026, with a June 11, 2026 fix deadline for FCEB agencies.
What you should know: A Qilin ransomware affiliate is using VPS servers geolocated in a target's own country to reach organizations there, and Check Point believes the same infrastructure is also exploiting VPN flaws in Palo Alto, Fortinet, and F5 products - so patching Check Point alone may not close the door this actor is using.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-50751CVE-2026-50752
- Related
- CVE-2026-50751: Check Point Security Gateway Improper Authentication Vulnerability Known Exploited Vulnerabilities · Jun 08, 2026Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026