What happened
On June 8, 2026, Check Point published an advisory for CVE-2026-50751, a critical (CVSS 9.3) authentication bypass in its Remote Access VPN, Mobile Access and Spark Firewall products. It was already being exploited: the earliest known activity dates to May 7, 2026, with an increase in early June. CISA added it to its Known Exploited Vulnerabilities (KEV) catalog.
According to Check Point, the campaign is limited, affecting several dozen organizations. At least one incident was linked, with medium confidence, to a Qilin ransomware affiliate. Rapid7 confirmed two cases.
Who is affected
The flaw hits gateways configured with the deprecated IKEv1 protocol that accept the legacy Remote Access client and don't require a machine certificate. In that setup, an attacker without credentials can establish a VPN session. Reaching internal resources still requires further steps, but the front door is open.
Affected versions: R80.20.X, R80.40, R81, R81.10 (all End of Support), R81.10.X, R81.20, R82, R82.00.X and R82.10.
Check Point also found a related flaw, CVE-2026-50752 (CVSS 7.4), enabling man-in-the-middle attacks on site-to-site tunnels in certain configurations. No exploitation of it has been observed.
What to do
- Apply Check Point's hotfix urgently, without waiting for the regular patch cycle.
- If you can't yet: remove legacy client support, set Remote Access authentication to IKEv2 only, make machine certificates mandatory and enable IPS with the latest signatures.
- Hunt for compromise in logs back to May 7, even after patching.
- Migrate off unsupported versions.
Lesson
Edge VPNs and firewalls remain favorite ransomware targets. Keeping old protocols enabled "for compatibility" opens the door to attacks like this one.
Sources
- Rapid7 (2026-06-08, updated): https://www.rapid7.com/blog/post/etr-critical-check-point-vpn-zero-day-exploited-in-the-wild-cve-2026-50751/
- Hive Pro, CISA KEV catalog June 2026: https://www.hivepro.com/threat-digests/cisa-known-exploited-vulnerability-catalog-june-2026
Does your company run an internet-facing VPN or firewall? KGA IT reviews the configuration for free: kga-it.com.