Critical Check Point VPN Flaw Exploited to Bypass Passwords in IKEv1 Setups

Check Point has warned of a critical IKEv1 VPN vulnerability (CVE-2026-50751, CVSS 9.3) allowing attackers to bypass password authentication and establish unauthorized remote access connections.

• •The flaw exists in certificate validation logic affecting Remote Access VPN and Mobile Access on deprecated IKEv1 protocol setups
• •Exploitation requires specific conditions: IKEv1 enabled, legacy client support, and no machine certificate requirement
• •Active exploitation observed from May 7, 2026, targeting a few dozen organizations globally with VPS infrastructure
• •Post-exploitation activity linked to Qilin ransomware affiliate attempting to download malicious ELF files
• •A second vulnerability (CVE-2026-50752, CVSS 7.40) enabling adversary-in-the-middle attacks on VPN site-to-site connections was also discovered