Security researchers are warning of widespread exploitation of a critical authentication bypass vulnerability, CVE-2026-50751, affecting Check Point’s Remote Access VPN and Mobile Access solutions. The flaw allows remote, unauthenticated attackers to circumvent user authentication protocols and establish a VPN connection without needing valid credentials like passwords or certificates. This represents a significant risk, enabling malicious actors to gain unauthorized access to sensitive network resources and potentially deploy ransomware.
The vulnerability stems from how Check Point’s systems handle IKEv1 key exchange negotiations. Attackers can manipulate authentication flags by crafting custom Vendor ID payloads, effectively tricking the system into granting access. A proof-of-concept (PoC) exploit leveraging this technique has been released, enabling wider exploitation. Researchers have built an IKEv1 client that completes phase-one negotiation with a random signature, allowing attackers to log in as provisioned Remote Access users without proper authentication.
Exploitation of CVE-2026-50751 has been observed in the wild since early May 2026, and Check Point first noticed suspicious activity related to the vulnerability on June 4, 2026. A particularly concerning aspect is that a Qilin ransomware affiliate is believed to be actively leveraging CVE-2026-50751 to compromise systems and deploy their malicious payload. This highlights the urgency for organizations using Check Point VPN solutions to apply the available patch immediately.
The flaw impacts both blades on Check Point Security Gateways configured to utilize the deprecated IKEv1 protocol, as well as Check Point’s AI-powered Spark firewalls. Organizations should conduct a thorough audit of their network infrastructure to identify any potentially affected devices and prioritize patching efforts.
To mitigate the risk, organizations are strongly advised to immediately apply the patch released by Check Point on June 8, 2026. Additionally, disabling IKEv1 key exchange protocol is a recommended best practice where possible, as it presents inherent security risks. Researchers have also released a ‘Detection Artefact Generator’ to aid in identifying and responding to potential exploitation attempts related to CVE-2026-50751.
Sources: