Article
Five edge VPN flaws CISA flags for ransomware use
Five VPN and firewall flaws added to CISA KEV in 2025 and 2026 carry a ransomware flag. Dates, fixed versions and what to check…
Read more
Exploited vulnerability
Check Point VPN login bypass (CVE-2026-50751)
CVE-2026-50751
CVE-2026-50751 is a flaw in Check Point Security Gateway remote access VPN that lets an outsider open a VPN session without a valid password.
- On CISA KEV
- CVE ID
- CVE-2026-50751
- CISA KEV
- Listed
- Affected product
- Security Gateway (Remote Access VPN and Mobile Access)
- Exploited
- Yes
- Published
- June 2026
In short
CVE-2026-50751 is a flaw in Check Point Security Gateway remote access VPN that lets an outsider open a VPN session without a valid password. It sits in IKEv1, an older and deprecated key exchange method. CISA lists it as exploited and flags known ransomware campaign use.
- CVECVE-2026-50751
- ProductCheck Point Security Gateway (Remote Access VPN and Mobile Access)
- CISA KEVListedKnown Exploited Vulnerabilities
- ExploitedYesin real attacks
- Fix Steps4actions listedInstall the hotfix · Turn off IKEv1 where you can
What it allows
An unauthenticated attacker can bypass user authentication and set up a remote access VPN connection without a valid user password. The vendor says more activity after login is needed to reach internal resources or gain higher rights. The vendor rates it CVSS 9.3, and NVD shows 9.3 (CVSS v3.1). This is a front door on the network edge, so a bypass gives an attacker a foothold inside.
Who is affected
The vendor lists Mobile Access and SSL VPN, Remote Access VPN and Spark Firewall on R80.20.X, R80.40, R81, R81.10 (all end of support), R81.10.X, R81.20, R82, R82.00.X and R82.10, when IKEv1 key exchange is used. Exact configurations and hotfix builds are in the vendor's advisory sk185033. A second flaw found during the work, CVE-2026-50752, affects site-to-site VPN certificate validation and was not seen exploited.
The vendor published its security advisory on 8 June 2026. It says its research team started investigating on 4 June 2026 and that the earliest observed exploitation was on 7 May 2026. Exploitation attempts rose in early June. The vendor says exploitation was limited to a few dozen targeted organizations worldwide, and it lists attacker IP addresses and file hashes in the advisory.
CISA added CVE-2026-50751 to its Known Exploited Vulnerabilities (KEV) catalog on 8 June 2026, with a due date of 11 June 2026. The KEV entry flags known ransomware campaign use. Attributed by Check Point (the vendor), 8 June 2026: one case showed confirmed activity after the break-in linked to a Qilin ransomware affiliate, and the vendor assesses with medium confidence that the actor is financially motivated. The vendor says that in some cases, attacks on Taiwanese organizations used attacker servers located in Taiwan. No government source names an actor.
Who exploits it
What to do
-
Install the hotfix
Update every affected Security Gateway to the hotfix named in advisory sk185033. End-of-support versions (R80.20.X to R81.10) need an upgrade to a supported release first.
-
Turn off IKEv1 where you can
The flaw is in the deprecated IKEv1 key exchange. The vendor describes alternative mitigation steps through remote access configuration settings in its advisory.
-
Review the past
Because exploitation was seen from 7 May 2026, audit VPN logs and gateway configuration back to that date, not only from the patch date.
-
Detect and hunt
Compare VPN logins with your user list and look for remote access sessions without a normal authentication trail. Block and search for the IP addresses and file hashes in the vendor advisory, and check Linux hosts reached through the VPN for unknown downloaded ELF files, which the vendor linked to Qilin binaries.
Questions
What is CVE-2026-50751?
It is an improper authentication flaw (CWE-287) in Check Point Security Gateway, a logic flaw in certificate validation in IKEv1. It lets an unauthenticated attacker bypass user authentication and set up a remote access VPN connection.
Which Check Point products are affected by CVE-2026-50751?
The vendor lists Mobile Access and SSL VPN, Remote Access VPN and Spark Firewall on several releases from R80.20.X to R82.10, when IKEv1 key exchange is used. Exact configurations and hotfix builds are in advisory sk185033.
How do I fix CVE-2026-50751?
Update every affected Security Gateway to the hotfix named in advisory sk185033. End-of-support versions from R80.20.X to R81.10 need an upgrade to a supported release first. Turn off IKEv1 where you can.
Is CVE-2026-50751 exploited in the wild?
Yes. The vendor says the earliest observed exploitation was on 7 May 2026 and that it was limited to a few dozen targeted organizations. CISA added it to the Known Exploited Vulnerabilities catalog on 8 June 2026.
Who is behind the CVE-2026-50751 attacks?
No government source names an actor. Check Point says one case showed confirmed activity after the break-in linked to a Qilin ransomware affiliate, and it assesses with medium confidence that the actor is financially motivated.
In our research
- Five edge VPN flaws CISA flags for ransomware use October 2026
Sources
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.