Check Point Security Gateway VPN sign-in bypass (CVE-2026-50751) exploited, including by a Qilin ransomware affiliate
Check Point firewalls with IKEv1 remote-access VPN can be logged into without a valid password (CVE-2026-50751). Used in attacks since 7 May, including a Qilin ransomware case. Install Check Point's hotfix or disable IKEv1/legacy clients, then check logs from 7 May.
If you run a Check Point gateway, install the fix for your version (for example R82.10 Take 24, R82 Take 107, R81.20 Take 146 or R81.10 Take 187) or apply Check Point's workarounds, and review VPN logs since 7 May 2026. Otherwise, nothing for you to do; ask your IT provider if unsure.
What’s happening
CVE-2026-50751 is a critical flaw (CVSS 9.3) in Check Point Security Gateways and Spark firewalls that offer remote-access VPN or Mobile Access using the old IKEv1 key exchange. A fault in certificate checking lets an attacker open a VPN session without a valid user password. Check Point says exploitation began no later than 7 May 2026, was limited to a few dozen targeted organisations, and in one case was followed by activity linked to a Qilin ransomware affiliate. CISA listed it as exploited on 8 June. Check Point published its advisory and a hotfix that day, and a second flaw, CVE-2026-50752 (CVSS 7.4), which it has not seen exploited. Fixes now exist for R82.10, R82, R81.20 and R81.10 and for Spark firewalls. Older end-of-support releases such as R80.40 and R80.20.X have no listed fix. Check Point also offers workarounds: turn off legacy clients, allow IKEv2 only, or require machine certificates. This mostly affects businesses, but home offices using these gateways are covered too.
- What
- Flaw
- Affects
- Check Point Security Gateways and Spark firewalls (remote access VPN / Mobile Access)
- Affected
- Security Gateways: R82.10 Take 19 or below
R82 Take 103 or below
R81.20 Take 141 or below
R81.10 (EOS)
R81 (EOS)
R80.40 (EOS)
Spark Firewalls (locally managed): R80.20.X (EOS), R81.10.X, R82.00.X - Fixed in
- R82.10 Take 24
R82 Take 107
R81.20 Take 146
R81.10 Take 187
Spark R82.00.10 Build 998002216
Spark R81.10.17 Build 996004901 - Since
- 8 June 2026
Timeline
- UpdatePartly fixed
Check Point last updated its support article. It lists Jumbo Hotfix Accumulators for R82.10 (Take 24), R82 (Take 107), R81.20 (Take 146) and R81.10 (Take 187), plus Spark firewall builds. No fix is listed for end-of-support R80.40 or R80.20.X.
- New fixPartly fixed
Check Point added more attacker indicators (9 to 11 June). The support article was revised on 11, 13, 14 and 15 June to add hotfixes, indicators and an IPS detection section.
- Made publicPartly fixed
Check Point published its advisory for CVE-2026-50751 (CVSS 9.3) and CVE-2026-50752 (CVSS 7.4) and released a hotfix. It said CVE-2026-50751 was exploited against a few dozen targeted organisations, one case involving a Qilin ransomware affiliate. CISA listed CVE-2026-50751 as exploited the same day.
- Update
Check Point Research began investigating after suspicious activity, and created its support article sk185033 the same day.
- Update
Earliest observed exploitation of the flaw, according to Check Point. Attacker activity was logged from this date to 8 June.
Sources
- Check Point releases important hotfix for vulnerabilities in deprecated IKEv1 VPN protocolCheck Point · 8 June 2026
- CVE-2026-50751: IKEv1 Remote Access Authentication Bypass (sk185033)Check Point · 24 Sept 2026