Check Point Security Gateway IKEv1 Remote Access/Mobile Access certificate-validation authentication bypass (CVSS 9.3), actively exploited by Qilin affiliate since 2026-05-07, CISA KEV

CVE-2026-50751: Check Point Security Gateway IKEv1 VPN authentication bypass, actively exploited, actor assessed with medium confidence to use Qilin ransomware

Check Point disclosed and patched CVE-2026-50751 (CVSS 9.3) on 8 June 2026. It is a logic-flow weakness in certificate validation in the deprecated IKEv1 key exchange affecting Remote Access VPN and Mobile Access deployments. An unauthenticated remote attacker can establish a VPN session without a valid user password; post-authentication activity is still required to reach internal resources (Check Point, 2026-06-08). Check Point has observed exploitation since 7 May against a few dozen targeted organizations, with one case showing confirmed post-compromise activity associated with a Qilin ransomware affiliate. Based on the post-exploitation activity it observed, Check Point assesses with medium confidence that the actor behind the exploitation is financially motivated and uses Qilin ransomware (Check Point, 2026-06-08). NCSC-CH issued an advisory the same day flagging the CVE as actively exploited and linking observed exploitation to a Qilin ransomware affiliate (NCSC-CH, 2026-06-08); CISA added the CVE to its KEV catalog on 8 June (CISA KEV catalog, 2026-06-08). The companion CVE-2026-50752 (CVSS 7.4, site-to-site IKEv1 MitM under specific conditions, no observed exploitation) should be patched in the same window.

Triage: Check Point says to treat every completed Quick Mode exchange recorded before the fix as suspicious, and the discriminator it gives is a user or source IP address the organisation does not recognise (Check Point, sk185033).