# Check Point VPN Flaw Exploited by Qilin Ransomware

Published: 2026-06-09 · Severity: high · Sectors: government-national
Canonical: https://vorant.io/reports/b7ff8b79-5497-5cb8-9553-e70397ca4699/check-point-vpn-flaw-exploited-by-qilin-ransomware

> An authentication bypass in Check Point VPN/Mobile Access products is being actively exploited, with one case tied to the Qilin ransomware operation.

Check Point has disclosed multiple vulnerabilities affecting its VPN Remote Access, Mobile Access, and Spark Firewall products, the most severe of which (CVE-2026-50751) allows an unauthenticated remote attacker to bypass authentication via a logic flaw in certificate validation for the deprecated IKEv1 key exchange. Exploitation requires VPN Remote Access or Mobile Access to be enabled with IKEv1 active, legacy clients accepted, and no machine certificate requirement enforced. Successful exploitation grants an attacker a remote access VPN connection without a valid password, potentially leading to unauthorized network access, data manipulation, or account creation depending on the compromised user's privileges.

A related vulnerability (CVE-2026-50752) affects site-to-site VPN connections using certificate-based authentication over IKEv1, enabling a man-in-the-middle attacker to bypass certificate validation and intercept or modify VPN tunnel traffic. Check Point has confirmed limited in-the-wild exploitation of CVE-2026-50751 and attributed at least one case to the Qilin ransomware operation, indicating the flaw is being used as an initial access vector for ransomware intrusions.

Affected systems span multiple Security Gateway and Spark Firewall versions, including several end-of-support releases still in active use. CIS/MS-ISAC recommends immediate patching, disabling legacy IKEv1 support where feasible, enforcing machine certificate requirements, and standard vulnerability management practices including network segmentation and least privilege.

## Mentioned in this report

- Vulnerabilities: CVE-2026-50751 (KEV), CVE-2026-50752
- Threat actors: qilin
- Malware: Qilin

## Detection guidance (public sample)

### Check Point VPN Remote Access Session Established via IKEv1 Without Valid Authentication (CVE-2026-50751)

ATT&CK: T1190

Detects VPN Remote Access or Mobile Access session establishment on Check Point Security Gateways using the deprecated IKEv1 exchange where the session is logged as authenticated without a corresponding password/credential verification event, consistent with the CVE-2026-50751 certificate validation bypass used as an initial access vector. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Check Point VPN Remote Access Session Established via IKEv1 Without Valid Authentication
id: 38ca85e2-c8d0-57f1-9c93-0184913afdde
status: experimental
description: 'Identifies VPN Remote Access or Mobile Access connections on Check Point
  gateways negotiated over the deprecated IKEv1 exchange where the log shows a successful
  tunnel/session establishment but no valid password or MFA verification event, matching
  the behaviour of the CVE-2026-50751 authentication bypass exploited by Qilin ransomware
  for initial access. Requires that Check Point audit/VPN logs are ingested and normalized
  with fields for IKE version, auth method, and credential validation status.

  '
references:
- Check Point Security Advisory CVE-2026-50751
author: Vorant
logsource:
  product: checkpoint
  category: firewall
detection:
  selection_vpn_session:
    vpn_feature_name|contains:
    - Remote Access
    - Mobile Access
    ike_version: '1'
    action: Accept
  filter_valid_auth:
    auth_status: success
    password_verified: 'true'
  condition: selection_vpn_session and not filter_valid_auth
falsepositives:
- Legacy client migrations where IKEv1 is intentionally still enabled and legitimate
  certificate-only authentication is configured and expected
- Gateways with machine certificate enforcement misconfigured for legitimate business
  reasons
level: high
tags:
- attack.t1190
- attack.initial_access
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-check-point-products-could-allow-for-authentication-bypass_2026-055

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/b7ff8b79-5497-5cb8-9553-e70397ca4699/check-point-vpn-flaw-exploited-by-qilin-ransomware.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup