Check Point VPN Flaw Exploited by Qilin Ransomware
An authentication bypass in Check Point VPN/Mobile Access products is being actively exploited, with one case tied to the Qilin ransomware operation.
Sourcecisecurity.org — open the original
What to check
- Applies to
- The 2 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2026-50751 as exploited in the wild.
Check Point has disclosed multiple vulnerabilities affecting its VPN Remote Access, Mobile Access, and Spark Firewall products, the most severe of which (CVE-2026-50751) allows an unauthenticated remote attacker to bypass authentication via a logic flaw in certificate validation for the deprecated IKEv1 key exchange. Exploitation requires VPN Remote Access or Mobile Access to be enabled with IKEv1 active, legacy clients accepted, and no machine certificate requirement enforced. Successful exploitation grants an attacker a remote access VPN connection without a valid password, potentially leading to unauthorized network access, data manipulation, or account creation depending on the compromised user's privileges.
A related vulnerability (CVE-2026-50752) affects site-to-site VPN connections using certificate-based authentication over IKEv1, enabling a man-in-the-middle attacker to bypass certificate validation and intercept or modify VPN tunnel traffic. Check Point has confirmed limited in-the-wild exploitation of CVE-2026-50751 and attributed at least one case to the Qilin ransomware operation, indicating the flaw is being used as an initial access vector for ransomware intrusions.
Affected systems span multiple Security Gateway and Spark Firewall versions, including several end-of-support releases still in active use. CIS/MS-ISAC recommends immediate patching, disabling legacy IKEv1 support where feasible, enforcing machine certificate requirements, and standard vulnerability management practices including network segmentation and least privilege.
Mentioned in this report
Detection guidance
Check Point VPN Remote Access Session Established via IKEv1 Without Valid Authentication (CVE-2026-50751)
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects VPN Remote Access or Mobile Access session establishment on Check Point Security Gateways using the deprecated IKEv1 exchange where the session is logged as authenticated without a corresponding password/credential verification event, consistent with the CVE-2026-50751 certificate validation bypass used as an initial access vector. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Check Point VPN Remote Access Session Established via IKEv1 Without Valid Authentication
id: 38ca85e2-c8d0-57f1-9c93-0184913afdde
status: experimental
description: 'Identifies VPN Remote Access or Mobile Access connections on Check Point
gateways negotiated over the deprecated IKEv1 exchange where the log shows a successful
tunnel/session establishment but no valid password or MFA verification event, matching
the behaviour of the CVE-2026-50751 authentication bypass exploited by Qilin ransomware
for initial access. Requires that Check Point audit/VPN logs are ingested and normalized
with fields for IKE version, auth method, and credential validation status.
'
references:
- Check Point Security Advisory CVE-2026-50751
author: Vorant
logsource:
category: firewall
detection:
selection_vpn_session:
vpn_feature_name|contains:
- Remote Access
- Mobile Access
ike_version: '1'
action: Accept
filter_valid_auth:
auth_status: success
password_verified: 'true'
condition: selection_vpn_session and not filter_valid_auth
falsepositives:
- Legacy client migrations where IKEv1 is intentionally still enabled and legitimate
certificate-only authentication is configured and expected
- Gateways with machine certificate enforcement misconfigured for legitimate business
reasons
level: high
tags:
- attack.t1190
- attack.initial-access
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-check-point-products-could-allow-for-authentication-bypass_2026-055
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs, actors, and malware it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs