Check Point VPN flaws exploited by Qilin ransomware
Two IKEv1 authentication bypass flaws in Check Point VPN products are under active exploitation, with Qilin ransomware leveraging CVE-2026-50751 in targeted attacks.
Check Point has disclosed two critical vulnerabilities in its VPN Remote Access, Mobile Access, and Spark Firewall products that allow authentication bypass through weaknesses in deprecated IKEv1 key exchange mechanisms. CVE-2026-50751 permits unauthenticated remote attackers to establish VPN connections without valid credentials, while CVE-2026-50752 enables man-in-the-middle attacks against site-to-site VPN tunnels using certificate-based authentication. Both vulnerabilities affect multiple product versions including R82.10, R82, and R81.20 lines, with older end-of-life versions also impacted.
Check Point has confirmed limited exploitation of CVE-2026-50751 in the wild, attributing at least one incident to the Qilin ransomware operation. Successful exploitation grants unauthorized network access, enabling attackers to install programs, manipulate data, or create privileged accounts. The vulnerabilities are constrained by specific configuration requirements—IKEv1 must be enabled, legacy client acceptance configured, and machine certificate validation disabled for CVE-2026-50751—but represent a significant risk to organizations running affected configurations.
MS-ISAC recommends immediate patching through Check Point's available hotfixes, with priority given to systems meeting the exploitation prerequisites. Organizations should review VPN configurations to disable IKEv1 where feasible, enforce certificate-based authentication with machine certificates, and implement network segmentation to limit potential lateral movement following compromise.
Mentioned in this report
Detection guidance
Check Point VPN IKEv1 Authentication Bypass Attempt (CVE-2026-50751)
Detects successful IKEv1 VPN tunnel establishment on Check Point gateways where legacy client acceptance is enabled and machine certificate validation is disabled, consistent with exploitation of CVE-2026-50751. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Check Point VPN IKEv1 Authentication Bypass Attempt
id: f281907e-a45f-55e7-91db-4c3ca29a694b
status: experimental
description: 'Detects successful IKEv1-based VPN Remote Access or Mobile Access connections
established on Check Point gateways
without valid client certificate authentication, matching the exploitation prerequisites
for CVE-2026-50751
(unauthenticated VPN connection establishment via deprecated IKEv1 key exchange).
Requires Check Point gateway
logs (vpnd/ike) to be forwarded to the SIEM.
'
references:
- Check Point advisory on CVE-2026-50751 / CVE-2026-50752
author: Vorant
tags:
- attack.t1190
logsource:
category: firewall
product: checkpoint
detection:
selection:
ike_version: IKEv1
vpn_feature: RemoteAccess
connection_result: Success
filter_cert_valid:
auth_method: certificate
cert_validation: passed
condition: selection and not filter_cert_valid
falsepositives:
- Legitimate legacy VPN clients that still require IKEv1 and have not yet been migrated
to IKEv2
- Site-to-site tunnels intentionally configured without machine certificate validation
for lab/test environments
level: high
Privileged Local Account Creation Following Remote VPN Session Establishment
Detects creation of a new local administrator account on a Windows host shortly after a remote VPN authentication event, a common post-exploitation step following unauthorized VPN access such as the Check Point IKEv1 authentication bypass. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Privileged Local Account Creation Following Remote VPN Session
id: 49baba86-9151-585a-aebf-c71213da8352
status: experimental
description: 'Detects local user account creation with immediate addition to a privileged
local group (e.g. Administrators),
which the report describes as a common post-exploitation action after unauthorized
VPN network access is obtained
via exploitation of Check Point VPN authentication bypass vulnerabilities. This
should be correlated with VPN
gateway logs showing anomalous IKEv1 session establishment for the same time window.
'
references:
- Check Point advisory on CVE-2026-50751 / CVE-2026-50752
author: Vorant
tags:
- attack.t1190
- attack.t1136.001
logsource:
product: windows
service: security
detection:
selection_create:
EventID: 4720
selection_addgroup:
EventID: 4732
GroupName|contains:
- Administrators
- Domain Admins
- Enterprise Admins
condition: selection_create or selection_addgroup
falsepositives:
- Legitimate IT administration workflows creating new privileged service or admin
accounts
- Scheduled account provisioning by identity management systems
level: medium
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-check-point-products-could-allow-for-authentication-bypass_2026-055
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free