Check PointExploited incident
Check Point Remote Access VPN authentication bypass in deprecated IKEv1
CVE-2026-50751, CVE-2026-50752Critical, CVSS 9.3In CISA's Known Exploited Vulnerabilities catalog since 8 Jun 2026
- Exploited before a fix
- Known ransomware use
Response
- Silence
- 0h First public report to first vendor statement
- Exposure
- same day First public report to first fix
- Follow-through
- not dated First public report to a fix for every supported version
- Vendor silent
- Vendor statement, no fix
- Fixed for some versions
- Fixed when disclosed
- Date only, no time of day
Timeline and evidence
Open a moment to see its source and archived quote.
First public report
CVE record CVE-2026-50751 (CNA: Check Point)CuratedQuote verified
"assignerShortName":"checkpoint","dateReserved":"2026-06-07T09:42:08.251Z","datePublished":"2026-06-08T11:07:15.746Z"
Check Point's own disclosure is the earliest public signal found. sk185033 (not quotable, see notes) lists attacker IPs observed from 2026-05-07, i.e. about a month of exploitation before disclosure.
- Source
- CVE record CVE-2026-50751 (CNA: Check Point) cve record
- Recorded time
- Precision
- To the minute
- Origin
- Curated. Found by a researcher, with a verbatim quote and link.
- Quote check
- Found in the archived copy
- Snapshot
sha256:7c237a164999d80b…- Used in metrics
- Yes
6 more sources for this moment
CISA KEV (CVE-2026-50751)ClaimedQuote verified8 Jun 2026
Check Point Security Gateway Improper Authentication Vulnerability
Added to CISA's KEV catalog on 2026-06-08.
- Source
- CISA KEV (CVE-2026-50751) kev
- Recorded time
- Precision
- Date only (no time of day is shown)
- Origin
- Claimed. The date the source gives.
- Quote check
- Found in the archived copy
- Snapshot
sha256:ef8fffede5c47200…- Used in metrics
- No, kept for the record
Check Point blog (Lotem Finkelstein)CuratedQuote verified8 Jun 2026
Check Point Research has identified active exploitation of CVE-2026-50751, a critical authentication bypass vulnerability affecting Check Point Remote Access VPN and Mobile Access deployments configured to use the deprecated IKEv1 key exchange protocol.
Post dated 'June 8, 2026'.
- Source
- Check Point blog (Lotem Finkelstein) vendor blog
- Recorded time
- Precision
- Date only (no time of day is shown)
- Origin
- Curated. Found by a researcher, with a verbatim quote and link.
- Quote check
- Found in the archived copy
- Snapshot
sha256:cba9f176e52073e5…- Used in metrics
- No, kept for the record
CVE.org record CVE-2026-50751ClaimedQuote verified8 Jun 2026, 11:07 UTC
A logic flow weakness in Remote Access and Mobile Access certificate validation in deprecated IKEv1 key exchange allows an unauthenticated remote attacker to bypass user authentication and establish
CVE record published.
- Source
- CVE.org record CVE-2026-50751 cve record
- Recorded time
- Precision
- To the minute
- Origin
- Claimed. The date the source gives.
- Quote check
- Found in the archived copy
- Snapshot
sha256:7c237a164999d80b…- Used in metrics
- No, kept for the record
Bluesky postClaimedQuote not checked yet8 Jun 2026, 12:29 UTC
Qilin ransomware affiliate exploited Check Point VPN zero-day (CVE-2026-50751)
Earliest third-party post we hold.
- Source
- Bluesky post social
- Recorded time
- Precision
- To the minute
- Origin
- Claimed. The date the source gives.
- Quote check
- Not checked yet
- Snapshot
- No archived snapshot
- Used in metrics
- No, kept for the record
Mastodon postClaimedQuote not checked yet8 Jun 2026, 13:25 UTC
Check Point Exposes VPN Zero-Day Link to Qilin Ransomware Gang A critical VPN vulnerability, CVE-2026-50751, has been exploited in attacks linked to the notorious Qilin ransomware gang, affecting a handful of organizations worldwide. Check Point has released security
Earliest third-party post we hold.
- Source
- Mastodon post social
- Recorded time
- Precision
- To the minute
- Origin
- Claimed. The date the source gives.
- Quote check
- Not checked yet
- Snapshot
- No archived snapshot
- Used in metrics
- No, kept for the record
Research: watchtowrClaimedQuote verified12 Jun 2026, 05:17 UTC
Marking Your Own Homework (Check Point Remote Access VPN IKEv1 Authentication Bypass CVE-2026-50751)
Earliest mention we hold (a vetted outlet).
- Source
- Research: watchtowr research
- Recorded time
- Precision
- To the minute
- Origin
- Claimed. The date the source gives.
- Quote check
- Found in the archived copy
- Snapshot
sha256:0d89ad0e6238f050…- Used in metrics
- No, kept for the record
Vendor statement
at disclosure
CVE record CVE-2026-50751 (CNA: Check Point)CuratedQuote verified
"datePublished":"2026-06-08T11:07:15.746Z"
- Source
- CVE record CVE-2026-50751 (CNA: Check Point) cve record
- Recorded time
- Precision
- To the minute
- Origin
- Curated. Found by a researcher, with a verbatim quote and link.
- Quote check
- Found in the archived copy
- Snapshot
sha256:7c237a164999d80b…- Used in metrics
- Yes
1 more source for this moment
Check Point blog (Lotem Finkelstein)CuratedQuote verified8 Jun 2026
Check Point has observed active exploitation of this vulnerability in the wild.
- Source
- Check Point blog (Lotem Finkelstein) vendor blog
- Recorded time
- Precision
- Date only (no time of day is shown)
- Origin
- Curated. Found by a researcher, with a verbatim quote and link.
- Quote check
- Found in the archived copy
- Snapshot
sha256:cba9f176e52073e5…- Used in metrics
- No, kept for the record
First workaround
date onlysame day
Check Point blog (Lotem Finkelstein)CuratedQuote verified
alternative mitigation steps (via remote-access configuration settings)
The blog points to sk185033's mitigation options (remove legacy remote access client support, IKEv2-only, mandatory machine certificate). The blog has been updated since (IoCs added June 9-11), so it is not certain this sentence was present on June 8; sk185033 (created 2026-06-04) carries the mitigations in its embedded data.
- Source
- Check Point blog (Lotem Finkelstein) vendor blog
- Recorded time
- Precision
- Date only (no time of day is shown)
- Origin
- Curated. Found by a researcher, with a verbatim quote and link.
- Quote check
- Found in the archived copy
- Snapshot
sha256:cba9f176e52073e5…- Used in metrics
- Yes
First fix
date onlysame day
Check Point blog (Lotem Finkelstein)CuratedQuote verified
Customers using IKEv1 key exchange protocol are strongly encouraged to apply the available security updates immediately.
Hotfixes on top of specific Jumbo Hotfix takes for R81.20, R82 and R82.10 were available at disclosure per the blog ('Update all affected Security Gateways to the released hotfix.').
- Source
- Check Point blog (Lotem Finkelstein) vendor blog
- Recorded time
- Precision
- Date only (no time of day is shown)
- Origin
- Curated. Found by a researcher, with a verbatim quote and link.
- Quote check
- Found in the archived copy
- Snapshot
sha256:cba9f176e52073e5…- Used in metrics
- Yes
Fixed for all versions
No evidence yet of fixed releases for every supported branch.
Send this to your boss
Check Point VPN login bypass exploited, incl. by ransomware; hotfix since Jun 8
Attackers, including a Qilin ransomware affiliate, used a Check Point remote-access VPN flaw to connect without a password; Check Point released hotfixes when it disclosed it on 8 June 2026.
In plain words
Check Point's remote-access VPN had a flaw that let outsiders connect to company networks without a password when an old protocol setting was on, and attackers including a ransomware group used it. Check Point disclosed it and released fixes on 8 June 2026. If we use Check Point VPN, we need the fix installed or the old protocol turned off, and a check of VPN logs back to early May.
What happened and who is affected
What happened
On 8 June 2026 Check Point disclosed CVE-2026-50751, a logic flaw in certificate validation for Remote Access VPN and Mobile Access using the deprecated IKEv1 key exchange, which lets an attacker set up a VPN session without a valid password. Check Point said a few dozen organisations had been targeted, one with Qilin ransomware affiliate activity, and published hotfixes and configuration mitigations. Its advisory lists attacker infrastructure seen from 7 May 2026.
Who is affected
Security Gateways with Remote Access VPN or Mobile Access on R82.10 (JHF Take 19 or below), R82 (Take 103 or below), R81.20 (Take 141 or below) and end-of-support R81.10/R81/R80.40, plus Spark firewalls R81.10.X, R82.00.X and R80.20.X, when IKEv1 is enabled for remote access, legacy clients are accepted and machine certificates are not required.
Affected products
- Quantum Security Gateway (Remote Access VPN, Mobile Access)
- Spark Firewall
How we built this timeline
The blog post's URL slug is 'check-point-releases-important-hotfix-for-vulnerabilities-in-deprecated-ikev1-vpn-protocol' but its current title is 'Security Advisory – Action Required – Active Exploitation of Check Point VPN Authentication Bypass (CVE-2026-50751)' dated June 8, 2026. CVE-2026-50752 (IKEv1 site-to-site MITM, not exploited, sk185035) was fixed in the same release and is grouped here.
Fixed for all versions omitted: sk185033's revision history (only in the page's __NEXT_DATA__ script, not quotable) shows staggered additions, e.g. hotfixes for older R82 takes added 14 Jun 2026 and recommended JHF takes added 15 Jun 2026; the Spark build dates are not shown. Status 'patched' because sk185033 lists fixes for all affected lines as of 22 Oct 2026.
Ransomware: Qilin affiliate per the blog; KEV marks Known.
CVSS 9.3 per the blog table. R1 check (23 Oct 2026): 'bypass' is the vulnerability class. sk185033 later added hotfixes for older Jumbo Hotfix takes and recommended JHF takes (June 14-15, 2026), which extend coverage to more starting versions rather than correcting an incomplete fix.