Zerodayhub

Check Point IKEv1 VPN Authentication Bypass – CVE-2026-50751

TL;DR: A critical logic flaw in Check Point’s legacy IKEv1 VPN code lets an unauthenticated attacker establish a Remote Access or Mobile Access VPN session without a valid password. It is being exploited in the wild — including by a Qilin ransomware affiliate — and is on CISA’s KEV list. If you run Check Point gateways with IKEv1 remote access, apply the hotfix on an emergency basis.

Key takeaways

• CVE-2026-50751 is a CVSS 9.3 critical authentication bypass (CWE-287) in Check Point Remote Access VPN, Mobile Access / SSL VPN and Spark Firewall products configured for the deprecated IKEv1 key exchange.
• Exploitation has been observed in the wild since 7 May 2026, scaling up in early June; Check Point links at least one intrusion to a Qilin ransomware affiliate.
• It was added to the CISA Known Exploited Vulnerabilities catalogue on 8 June 2026, the same day Check Point published advisory sk185033.
• The fix is a Jumbo Hotfix; four of the nine affected branches (R80.20.X, R80.40, R81, R81.10) are already end-of-support and must be migrated.
• Even after patching, hunt for compromise from 7 May onwards — a successful bypass leaves attackers with a foothold inside the network perimeter.

What is CVE-2026-50751?

CVE-2026-50751 is a critical authentication bypass in Check Point’s gateway VPN products. On 8 June 2026 Check Point published advisory sk185033 describing a logic flaw in how the Remote Access and Mobile Access components validate certificates during an IKEv1 key exchange. Where a gateway is configured to accept legacy Remote Access clients and does not mandate a machine certificate, an unauthenticated attacker can negotiate a VPN session without ever presenting valid credentials.

The flaw matters because the affected products sit on the network perimeter and exist precisely to keep unauthenticated outsiders out. A working bypass hands an attacker the one thing a VPN is supposed to deny: an authenticated-looking tunnel into the corporate network. With a CVSS v3.1 base score of 9.3 and confirmed exploitation in the wild, this is a patch-now situation rather than a routine maintenance item.

How the Check Point exploit works

In plain terms: the gateway is supposed to check that whoever is connecting holds a legitimate certificate before it lets them set up a VPN session. Because of a logic weakness in the IKEv1 path, that check can be satisfied without the attacker actually possessing valid credentials, so the gateway brings up the tunnel for them anyway.

In more depth, the root cause is improper authentication (CWE-287) in the certificate-validation logic used during IKEv1 key exchange. IKEv1 is a deprecated key-exchange protocol that Check Point still supports for backwards compatibility with older Remote Access clients. The vulnerable code path is reachable when two pre-conditions are met: the gateway accepts legacy Remote Access clients, and it is not configured to require a machine certificate for connections. Under those conditions the certificate-validation step can be coerced into accepting an unauthenticated session, allowing the attacker to complete the IKEv1 negotiation and establish a Remote Access or Mobile Access VPN tunnel.

Two points keep this from being a single-shot full compromise, and both are reflected in the CVSS vector (C:H/I:L/A:N). First, Check Point notes that additional post-authentication activity is required to reach internal resources or escalate privileges — the bypass gets you onto the tunnel, not automatically to domain admin. Second, the scope is marked as changed (S:C) because the impact crosses from the VPN component into the protected network it fronts. None of this reduces the urgency: getting an unauthenticated tunnel onto a target network is exactly the launch pad ransomware operators want.

# NON-OPERATIONAL ILLUSTRATION ONLY — not a working exploit.
# Conceptual view of the abused condition, not attack code.
Gateway config (vulnerable):
  remote_access.ikev1            = enabled       # deprecated protocol still accepted
  remote_access.legacy_clients   = allowed       # legacy RA clients permitted
  remote_access.require_machine_certificate = false   # <-- key missing control
IKEv1 negotiation:
  client -> gateway : initiate IKEv1 exchange (no valid credential)
  gateway           : certificate-validation logic fails open
  gateway -> client : VPN session established  (authentication bypassed)

The snippet above is deliberately illustrative — it shows the configuration condition and the high-level negotiation outcome, not a functioning exploit or payload.

Is CVE-2026-50751 actively exploited?

Yes. Check Point states the vulnerability has been exploited in the wild, with the earliest observed activity dating to 7 May 2026 and a noticeable increase in early June. The vendor characterises the campaign as limited in scope — affecting several dozen organisations globally — and assesses with medium confidence that at least one intrusion is tied to a Qilin ransomware affiliate. Rapid7 independently reported two cases it attributes to CVE-2026-50751 with high confidence.

CISA added CVE-2026-50751 to its Known Exploited Vulnerabilities (KEV) catalogue on 8 June 2026, obliging US Federal Civilian Executive Branch agencies to remediate within the standard KEV deadline and signalling to everyone else that this is being used against real targets now. Check Point’s published indicators point to attacker infrastructure hosted on VPS providers (Kaupo Cloud HK, Shock Hosting, Vultr), with post-exploitation attempts to pull ELF payloads from attacker-controlled servers.

Separately, during the same investigation Check Point identified a related but lower-severity flaw, CVE-2026-50752 (CVSS 7.4), in the same IKEv1 code path; it could enable a man-in-the-middle attack against site-to-site tunnels under certain configurations. No exploitation of CVE-2026-50752 has been reported.

How to fix CVE-2026-50751: remediation & mitigation

Patch: Apply the Jumbo Hotfix that Check Point has released for the affected branches, as documented in advisory sk185033. Reported vulnerable Takes include R82.10 Jumbo Hotfix Take 19 or below, R82 Jumbo Hotfix Take 103 or below and R81.20 Jumbo Hotfix Take 141 or below — install a Take above the vulnerable one for your version. Treat this as an emergency change rather than waiting for a scheduled maintenance window. Four affected branches (R80.20.X, R80.40, R81, R81.10) are end-of-support and will not receive a fix on the old release — migrate those gateways to a supported version.

If you can’t patch immediately:

• Configure Remote Access VPN authentication to IKEv2 only and disable IKEv1.
• Set machine certificate authentication as mandatory for remote access connections.
• Remove support for the legacy remote access client.
• Enable IPS and download the latest signatures so the gateway can flag known exploitation attempts.

After patching: Assume that a vulnerable, internet-facing gateway may already have been reached. Review VPN and gateway logs for anomalous Remote Access / Mobile Access sessions from 7 May 2026 onwards, audit configuration changes, terminate suspicious sessions and rotate any credentials that could have been exposed once an attacker had a tunnel into the network.

Detection / IOCs: Check Point’s advisory lists attacker IP addresses (including 45.77.149[.]152, 209.182.225[.]136, 38.60.157[.]139, 162.33.177[.]101, 45.76.26[.]42, 144.208.127[.]155, 38.54.88[.]201, 38.54.107[.]167 and 66.42.99[.]200) and ELF payload MD5 hashes (52fda5c1b9704544f32ee98d9060e689 and 51d39aa39478beeac94f2d12f682ecce). Always cross-check against the vendor advisory for the current, authoritative IOC list, as infrastructure changes over time.

Frequently asked questions

Is CVE-2026-50751 a remote code execution bug?

No — it is an authentication bypass. It lets an unauthenticated attacker establish a VPN session, which Check Point notes requires further post-authentication activity to reach internal resources or escalate privileges. That said, an unauthenticated foothold on the perimeter is more than enough to be dangerous, which is why it scores 9.3.

Am I affected if I only use IKEv2?

The vulnerable code path is in the deprecated IKEv1 key exchange and is reachable when the gateway accepts legacy Remote Access clients and does not require a machine certificate. Restricting authentication to IKEv2 only is one of Check Point’s recommended mitigations, but you should still apply the hotfix.

Is there a public exploit?

Active in-the-wild exploitation is confirmed by Check Point and Rapid7, and the flaw is on CISA’s KEV list. We are not linking to or detailing working exploit code. Treat any internet-facing, unpatched IKEv1 gateway as at imminent risk.

What is the connection to Qilin ransomware?

Check Point assesses with medium confidence that at least one intrusion exploiting CVE-2026-50751 is linked to a Qilin ransomware affiliate, based on post-exploitation binary analysis. This fits the wider pattern of ransomware crews weaponising edge-device and VPN flaws for initial access.

Sources & further reading

• Check Point advisory sk185033 (vendor) — support.checkpoint.com/results/sk/sk185033
• Check Point blog: hotfix for IKEv1 VPN vulnerabilities — blog.checkpoint.com
• NVD entry for CVE-2026-50751 — nvd.nist.gov
• CISA Known Exploited Vulnerabilities catalog — cisa.gov
• Rapid7 Emergent Threat Response — rapid7.com
• The Hacker News: critical Check Point VPN flaw exploited — thehackernews.com
• Help Net Security: Qilin affiliate exploited Check Point VPN zero-day — helpnetsecurity.com

ZeroDayHub tracks critical vulnerabilities as they break. Subscribe for updates.