Check Point VPN flaws exploited by Qilin ransomware
Two IKEv1 authentication bypass flaws in Check Point VPN products are under active exploitation, with Qilin ransomware leveraging CVE-2026-50751 in targeted attacks.
Sourcecisecurity.org — open the original
What to check
- Applies to
- The 2 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2026-50751 as exploited in the wild.
Check Point has disclosed two critical vulnerabilities in its VPN Remote Access, Mobile Access, and Spark Firewall products that allow authentication bypass through weaknesses in deprecated IKEv1 key exchange mechanisms. CVE-2026-50751 permits unauthenticated remote attackers to establish VPN connections without valid credentials, while CVE-2026-50752 enables man-in-the-middle attacks against site-to-site VPN tunnels using certificate-based authentication. Both vulnerabilities affect multiple product versions including R82.10, R82, and R81.20 lines, with older end-of-life versions also impacted.
Check Point has confirmed limited exploitation of CVE-2026-50751 in the wild, attributing at least one incident to the Qilin ransomware operation. Successful exploitation grants unauthorized network access, enabling attackers to install programs, manipulate data, or create privileged accounts. The vulnerabilities are constrained by specific configuration requirements—IKEv1 must be enabled, legacy client acceptance configured, and machine certificate validation disabled for CVE-2026-50751—but represent a significant risk to organizations running affected configurations.
MS-ISAC recommends immediate patching through Check Point's available hotfixes, with priority given to systems meeting the exploitation prerequisites. Organizations should review VPN configurations to disable IKEv1 where feasible, enforce certificate-based authentication with machine certificates, and implement network segmentation to limit potential lateral movement following compromise.
Mentioned in this report
Detection guidance
Check Point VPN IKEv1 Authentication Bypass Attempt (CVE-2026-50751)
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects successful IKEv1 VPN tunnel establishment on Check Point gateways where legacy client acceptance is enabled and machine certificate validation is disabled, consistent with exploitation of CVE-2026-50751. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Check Point VPN IKEv1 Authentication Bypass Attempt
id: f281907e-a45f-55e7-91db-4c3ca29a694b
status: experimental
description: 'Detects successful IKEv1-based VPN Remote Access or Mobile Access connections
established on Check Point gateways
without valid client certificate authentication, matching the exploitation prerequisites
for CVE-2026-50751
(unauthenticated VPN connection establishment via deprecated IKEv1 key exchange).
Requires Check Point gateway
logs (vpnd/ike) to be forwarded to the SIEM.
'
references:
- Check Point advisory on CVE-2026-50751 / CVE-2026-50752
author: Vorant
tags:
- attack.t1190
logsource:
category: firewall
detection:
selection:
ike_version: IKEv1
vpn_feature: RemoteAccess
connection_result: Success
filter_cert_valid:
auth_method: certificate
cert_validation: passed
condition: selection and not filter_cert_valid
falsepositives:
- Legitimate legacy VPN clients that still require IKEv1 and have not yet been migrated
to IKEv2
- Site-to-site tunnels intentionally configured without machine certificate validation
for lab/test environments
level: high
Privileged Local Account Creation Following Remote VPN Session Establishment
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects creation of a new local administrator account on a Windows host shortly after a remote VPN authentication event, a common post-exploitation step following unauthorized VPN access such as the Check Point IKEv1 authentication bypass. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Privileged Local Account Creation Following Remote VPN Session
id: 49baba86-9151-585a-aebf-c71213da8352
status: experimental
description: 'Detects local user account creation with immediate addition to a privileged
local group (e.g. Administrators),
which the report describes as a common post-exploitation action after unauthorized
VPN network access is obtained
via exploitation of Check Point VPN authentication bypass vulnerabilities. This
should be correlated with VPN
gateway logs showing anomalous IKEv1 session establishment for the same time window.
'
references:
- Check Point advisory on CVE-2026-50751 / CVE-2026-50752
author: Vorant
tags:
- attack.t1190
- attack.t1136.001
logsource:
product: windows
service: security
detection:
selection_create:
EventID: 4720
selection_addgroup:
EventID: 4732
GroupName|contains:
- Administrators
- Domain Admins
- Enterprise Admins
condition: selection_create or selection_addgroup
falsepositives:
- Legitimate IT administration workflows creating new privileged service or admin
accounts
- Scheduled account provisioning by identity management systems
level: medium
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-check-point-products-could-allow-for-authentication-bypass_2026-055
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs and actors it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs