{"id":"check-point-ikev1-vpn-auth-bypass-jun-2026","category":"patch","status":"live","title":"Check Point Security Gateway VPN sign-in bypass (CVE-2026-50751) exploited, including by a Qilin ransomware affiliate","tldr":"Check Point firewalls with IKEv1 remote-access VPN can be logged into without a valid password (CVE-2026-50751). Used in attacks since 7 May, including a Qilin ransomware case. Install Check Point's hotfix or disable IKEv1/legacy clients, then check logs from 7 May.","summary":"CVE-2026-50751 is a critical flaw (CVSS 9.3) in Check Point Security Gateways and Spark firewalls that offer remote-access VPN or Mobile Access using the old IKEv1 key exchange. A fault in certificate checking lets an attacker open a VPN session without a valid user password. Check Point says exploitation began no later than 7 May 2026, was limited to a few dozen targeted organisations, and in one case was followed by activity linked to a Qilin ransomware affiliate. CISA listed it as exploited on 8 June. Check Point published its advisory and a hotfix that day, and a second flaw, CVE-2026-50752 (CVSS 7.4), which it has not seen exploited. Fixes now exist for R82.10, R82, R81.20 and R81.10 and for Spark firewalls. Older end-of-support releases such as R80.40 and R80.20.X have no listed fix. Check Point also offers workarounds: turn off legacy clients, allow IKEv2 only, or require machine certificates. This mostly affects businesses, but home offices using these gateways are covered too.","action":"If you run a Check Point gateway, install the fix for your version (for example R82.10 Take 24, R82 Take 107, R81.20 Take 146 or R81.10 Take 187) or apply Check Point's workarounds, and review VPN logs since 7 May 2026. Otherwise, nothing for you to do; ask your IT provider if unsure.","product":"Check Point Security Gateways and Spark firewalls (remote access VPN / Mobile Access)","audience":"work","severity":"critical","patch":"partial","exploited":true,"cves":["CVE-2026-50751","CVE-2026-50752"],"tags":["check-point","vpn","firewall","ikev1","authentication-bypass","ransomware","qilin","actively-exploited"],"affected":["Security Gateways: R82.10 Take 19 or below","R82 Take 103 or below","R81.20 Take 141 or below","R81.10 (EOS)","R81 (EOS)","R80.40 (EOS)","Spark Firewalls (locally managed): R80.20.X (EOS), R81.10.X, R82.00.X"],"fixed":["R82.10 Take 24","R82 Take 107","R81.20 Take 146","R81.10 Take 187","Spark R82.00.10 Build 998002216","Spark R81.10.17 Build 996004901"],"matches":[],"sources":[{"kind":"advisory","title":"Check Point releases important hotfix for vulnerabilities in deprecated IKEv1 VPN protocol","url":"https://blog.checkpoint.com/security/check-point-releases-important-hotfix-for-vulnerabilities-in-deprecated-ikev1-vpn-protocol/","by":"Check Point","date":"2026-06-08"},{"kind":"advisory","title":"CVE-2026-50751: IKEv1 Remote Access Authentication Bypass (sk185033)","url":"https://support.checkpoint.com/results/sk/sk185033","by":"Check Point","date":"2026-09-24"}],"started":"2026-06-08","closed":null,"created":"2026-11-03T21:47:04.465Z","updated":"2026-11-03T21:47:04.465Z","cve_notes":[{"cve":"CVE-2026-50751","name":"Check Point VPN sign-in bypass via IKEv1 certificate check","what":"A logic flaw in certificate validation in the old IKEv1 key exchange of Check Point's remote access VPN that lets an unauthenticated attacker open a VPN connection without a valid password, then pursue further access.","severity":"critical","cvss":9.3},{"cve":"CVE-2026-50752","name":"Check Point IKEv1 certificate check weakness in site VPNs","what":"A certificate validation weakness in IKEv1 that could let an attacker in a position to intercept traffic interfere with site-to-site VPN connections under specific conditions; Check Point has not seen it exploited.","severity":"high","cvss":7.4}],"timeline":[{"at":"2026-09-24","added":"2026-11-03T21:46:16.197Z","kind":"other","text":"Check Point last updated its support article. It lists Jumbo Hotfix Accumulators for R82.10 (Take 24), R82 (Take 107), R81.20 (Take 146) and R81.10 (Take 187), plus Spark firewall builds. No fix is listed for end-of-support R80.40 or R80.20.X.","url":"https://support.checkpoint.com/results/sk/sk185033","by":"Check Point","patch":"partial"},{"at":"2026-06-11","added":"2026-11-03T21:46:16.197Z","kind":"new-fix","text":"Check Point added more attacker indicators (9 to 11 June). The support article was revised on 11, 13, 14 and 15 June to add hotfixes, indicators and an IPS detection section.","url":"https://support.checkpoint.com/results/sk/sk185033","by":"Check Point","patch":"partial"},{"at":"2026-06-08","added":"2026-11-03T21:46:16.197Z","kind":"disclosed","text":"Check Point published its advisory for CVE-2026-50751 (CVSS 9.3) and CVE-2026-50752 (CVSS 7.4) and released a hotfix. It said CVE-2026-50751 was exploited against a few dozen targeted organisations, one case involving a Qilin ransomware affiliate. CISA listed CVE-2026-50751 as exploited the same day.","url":"https://blog.checkpoint.com/security/check-point-releases-important-hotfix-for-vulnerabilities-in-deprecated-ikev1-vpn-protocol/","by":"Check Point","patch":"partial"},{"at":"2026-06-04","added":"2026-11-03T21:46:16.197Z","kind":"other","text":"Check Point Research began investigating after suspicious activity, and created its support article sk185033 the same day.","url":"https://support.checkpoint.com/results/sk/sk185033","by":"Check Point","patch":null},{"at":"2026-05-07","added":"2026-11-03T21:46:16.197Z","kind":"other","text":"Earliest observed exploitation of the flaw, according to Check Point. Attacker activity was logged from this date to 8 June.","url":"https://blog.checkpoint.com/security/check-point-releases-important-hotfix-for-vulnerabilities-in-deprecated-ikev1-vpn-protocol/","by":"Check Point","patch":null}],"url":"https://hard.fyi/live/check-point-ikev1-vpn-auth-bypass-jun-2026/","json":"https://hard.fyi/api/live?id=check-point-ikev1-vpn-auth-bypass-jun-2026"}