--- schema: 1 kind: vulnerability title: Check Point IKEv1 VPN Authentication Bypass (CVE-2026-50751) headline: Check Point IKEv1 VPN Authentication Bypass (CVE-2026-50751) summary: "On 8 June 2026 Check Point disclosed and shipped a hotfix for CVE-2026-50751 (CVSS 9.3), an authentication bypass affecting Remote Access VPN and Mobile Access gateways configured for the deprecated IKEv1 key exchange (Check Point, 2026-06-08)." discovered_at: "2026-06-09T05:00:08Z" event_date: 2026-06-08 run_id: 2026-06-09-40d562df priority: notable immediate_action: null tags: - vulnerabilities - actively-exploited - auth-bypass - pre-auth - cisa-kev - ransomware regions: - global - switzerland sectors: - public-sector entities: [] cves: - id: CVE-2026-50751 cvss: "9.3" epss: null type: auth-bypass vector: zero-click auth: pre-auth status: - exploited - cisa-kev - patch-available sources: - url: "https://blog.checkpoint.com/security/check-point-releases-important-hotfix-for-vulnerabilities-in-deprecated-ikev1-vpn-protocol/" publisher: Check Point advisory role: primary - url: "https://security-hub.ncsc.admin.ch/#/posts/12615" publisher: NCSC-CH Security Hub role: corroborating - url: "https://www.rapid7.com/blog/post/etr-critical-check-point-vpn-zero-day-exploited-in-the-wild-cve-2026-50751/" publisher: Rapid7 role: corroborating - url: "https://www.bleepingcomputer.com/news/security/check-point-links-vpn-zero-day-attacks-to-qilin-ransomware-gang/" publisher: BleepingComputer role: corroborating closed_sources: [] evidence: - quote: "On 8 June 2026 Check Point disclosed and shipped a hotfix for CVE-2026-50751 (CVSS 9.3), an authentication bypass affecting Remote Access VPN and Mobile Access gateways configured for the deprecated IKEv1 key exchange (Check Point, 2026-06-08)." publisher: ctipilot v2 brief (migrated) verification: multi-source sourcing_note: "migration: evidence backfilled from v2 brief body (item predates the Evidence footer field)" confidence: high update_of: null references: [] deep_dive: true deep_dive_category: firewall-vpn-rce org_triage: null watchlist_hit: false actions: [] migrated_from: briefs/2026-06-09.md --- On 8 June 2026 Check Point disclosed and shipped a hotfix for CVE-2026-50751 (CVSS 9.3), an authentication bypass affecting Remote Access VPN and Mobile Access gateways configured for the deprecated IKEv1 key exchange ([Check Point, 2026-06-08](https://blog.checkpoint.com/security/check-point-releases-important-hotfix-for-vulnerabilities-in-deprecated-ikev1-vpn-protocol/)). The disclosure is notable not for its novelty as a bug class but for its timeline: exploitation began no later than 7 May 2026 — a full month before public disclosure — surged in early June, and is attributed by Check Point to a financially-motivated actor deploying Qilin ransomware ([Help Net Security, 2026-06-08](https://www.helpnetsecurity.com/2026/06/08/check-point-cve-2026-50751-qilin-ransomware/)). NCSC-CH issued an Action-Required advisory the same day, flagging the CVE as actively exploited ([NCSC-CH, 2026-06-08](https://security-hub.ncsc.admin.ch/#/posts/12615)). **Mechanics.** The flaw is a logic-flow weakness in certificate validation within the IKEv1 Remote Access / Mobile Access path. An unauthenticated remote attacker can exploit it to establish a VPN session without presenting a valid user password — defeating the authentication step that the VPN front-end is supposed to enforce ([Rapid7, 2026-06-08](https://www.rapid7.com/blog/post/etr-critical-check-point-vpn-zero-day-exploited-in-the-wild-cve-2026-50751/)). Importantly, the bypass yields a VPN session, not direct code execution: post-authentication activity — credential abuse, lateral movement, privilege escalation — is still required to reach internal resources. The exposure surface is gateways still running deprecated IKEv1 (not the current IKEv2); legacy Remote Access clients that default to IKEv1 are the principal liability. **Kill chain.** Initial access maps to [T1190 Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190/): the attacker reaches the internet-exposed VPN portal and forges a session via the certificate-validation bypass. From the VPN-assigned address space the actor pivots using [T1078 Valid Accounts](https://attack.mitre.org/techniques/T1078/) — operating from inside the trust boundary the VPN was meant to gate — toward the credential-access, lateral-movement and impact stages that precede Qilin ransomware deployment. Check Point assesses the same actor is concurrently scanning Palo Alto (PAN-OS), Fortinet and F5 VPN products, consistent with an edge-device-focused access broker feeding a ransomware operation ([Check Point, 2026-06-08](https://blog.checkpoint.com/security/check-point-releases-important-hotfix-for-vulnerabilities-in-deprecated-ikev1-vpn-protocol/)); BleepingComputer corroborates the Qilin linkage ([BleepingComputer, 2026-06-08](https://www.bleepingcomputer.com/news/security/check-point-links-vpn-zero-day-attacks-to-qilin-ransomware-gang/)). **Affected and patched versions.** Affected trains span R80.20.X, R80.40, R81, R81.10 (these four End-of-Support), R81.10.X, R81.20, R82, R82.00.X and R82.10, plus Spark appliances; the remediation is the hotfix and fixed releases documented in Check Point sk185033 ([Check Point sk185033](https://support.checkpoint.com/results/sk/sk185033)). Check Point also disclosed CVE-2026-50752 (CVSS 7.4), a separate IKEv1 weakness enabling man-in-the-middle interference on site-to-site connections — not exploited in the wild but to be patched in the same maintenance window. **Hunt and detection concepts.** Because exploitation predates disclosure by a month, forensic lookback should start 7 May 2026. Review VPN authentication logs for remote-access sessions established without a matching MFA/password event; flag sessions negotiated over IKEv1-only tunnels where the estate is otherwise IKEv2. Treat lateral movement originating from VPN-assigned address ranges as a hunt anchor — authentication and access events sourced from the VPN pool to internal services shortly after an anomalous session establishment. With confirmed in-the-wild exploitation pre-dating disclosure by a month, the case argues for compressing the change window rather than waiting for IPS coverage to mature. **Hardening.** Apply the sk185033 hotfix immediately; where patching lags, the structural mitigation is to disable legacy IKEv1 remote-access client support and migrate to IKEv2, which removes the vulnerable path entirely. Enforce mandatory machine-certificate authentication and enable IPS with updated signatures as a stopgap. The broader lesson for Swiss/EU public-sector estates is the recurring one for internet-exposed edge appliances: a deprecated-but-enabled protocol is an attack surface, and the gap between silent exploitation and vendor disclosure is where ransomware access brokers operate.