Check Point VPN CVE‑2026‑50751 exploited by Qilin ransomware

A critical vulnerability in Check Point's Remote Access VPN and Mobile Access products has been actively exploited since early May, allowing attackers to bypass authentication and establish unauthorized VPN sessions. The flaw, tracked as CVE-2026-50751, is being leveraged by an affiliate of the Qilin ransomware group and has targeted a few dozen organizations globally.

The vulnerability, which carries a critical CVSS score of 9.3, affects deployments configured to use the deprecated IKEv1 key exchange protocol. It stems from a logic flaw in certificate validation, enabling an unauthenticated remote attacker to establish a VPN session without a valid user password. While this grants initial access, additional post-authentication steps are required to reach internal network resources or escalate privileges.

Check Point Research launched its investigation on June 4, 2026, after detecting suspicious activity. The investigation traced the earliest confirmed exploitation attempts back to May 7, with a sharp escalation in attacks occurring in early June. In at least one confirmed case, the initial access led to post-compromise activity linked to the Qilin ransomware operation.