# Check Point Remote Access & Mobile Access VPN IKEv1 Authentication Bypass (CVE-2026-50751) Exploited by Qilin Ransomware Affiliate

> CVE-2026-50751 is a critical (CVSS 9.3) authentication bypass in Check Point Remote Access VPN, Mobile Access, and Spark firewalls configured for the deprecated IKEv1 key exchange protocol. A logic flaw in certificate validation lets a remote, unauthenticated attacker establish a VPN session without a valid password. Exploited in the wild since at least 7 May 2026 against dozens of organizations, with at least one intrusion attributed to a Qilin ransomware affiliate.

- **Published:** 2026-06-08T00:00:00Z
- **Last reviewed:** 2026-08-04T03:48:51.762Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0718
- **ID:** TL-2026-0718
- **Severity:** CRITICAL (CVSS 9.3)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Actor:** Qilin ransomware affiliate
- **Detections:** 9 · **IOCs:** 28 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-50751, CVE-2026-50752

## Description

Check Point disclosed on 8 June 2026 the active exploitation of CVE-2026-50751, a user authentication bypass affecting Remote Access VPN and Mobile Access (SSL VPN) gateways, as well as AI-powered Spark firewalls, when these are configured to use the deprecated IKEv1 key exchange protocol. The vulnerability is a logic-flow weakness in the certificate-validation routine of the IKEv1 Remote Access / Mobile Access path: by manipulating the IKEv1 authentication exchange, a remote and unauthenticated attacker can complete VPN session establishment without presenting valid user credentials. Check Point assigns the flaw a CVSS score of 9.3 (Critical) and maps it to improper authentication (CWE-287). A companion issue, CVE-2026-50752 (CVSS 7.4), was patched in the same hotfix.

Exploitation does not by itself grant access to internal resources or elevated privileges — additional post-authentication activity is required once the attacker holds a VPN foothold. In the observed intrusions the actor used the unauthorized VPN access as initial access, then moved laterally, staged data, and exfiltrated it using the legitimate open-source utility Rclone before, in at least one confirmed case, deploying Qilin (Agenda) ransomware. The actor is assessed with medium confidence to be a financially motivated Qilin ransomware affiliate. Command-and-control and victim communication leveraged the Tox peer-to-peer messaging protocol, a tradecraft pattern common to Qilin operations.

Attacker infrastructure consisted of dedicated VPS instances hosted at Kaupo Cloud HK, Shock Hosting, and Vultr Holdings, with VPS geography frequently correlated to the geography of the targeted organization to blend with expected remote-access traffic. Check Point first observed suspicious activity on 4 June 2026 and traced the earliest known exploitation to 7 May 2026. Organizations running IKEv1-enabled Remote Access / Mobile Access on affected versions should apply the hotfix immediately (refer to Check Point SK185033 / SK185035), or, where patching is not immediately possible, disable IKEv1, remove legacy Remote Access client support, and require machine certificates for VPN connections. Incident responders should audit VPN authentication logs and gateway configuration changes from 7 May 2026 onward.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1212 Exploitation for Credential Access
- T1078 Valid Accounts
- T1018 Remote System Discovery
- T1021 Remote Services
- T1039 Data from Network Shared Drive
- T1071 Application Layer Protocol
- T1567 Exfiltration Over Web Service
- T1537 Transfer Data to Cloud Account
- T1486 Data Encrypted for Impact
- T1657 Financial Theft
- T1583 Acquire Infrastructure
- T1059 Command and Scripting Interpreter
- T1569 System Services
- T1098 Account Manipulation
- T1003 OS Credential Dumping
- T1087 Account Discovery
- T1046 Network Service Discovery
- T1550 Use Alternate Authentication Material
- T1005 Data from Local System
- T1572 Protocol Tunneling
- T1105 Ingress Tool Transfer
- T1490 Inhibit System Recovery

## Sources

- [Security Advisory – Active Exploitation of Check Point VPN Authentication Bypass (CVE-2026-50751)](https://blog.checkpoint.com/security/check-point-releases-important-hotfix-for-vulnerabilities-in-deprecated-ikev1-vpn-protocol/)
- [Qilin ransomware affiliate exploited Check Point VPN zero-day (CVE-2026-50751)](https://www.helpnetsecurity.com/2026/06/08/check-point-cve-2026-50751-qilin-ransomware/)
- [Check Point Software links newly identified CVE to VPN attacks](https://www.cybersecuritydive.com/news/check-point-cve-vpn-attacks/717366/)
- [CVE-2026-50751 — User Authentication Bypass in VPN Remote Access and Mobile Access](https://cvefeed.io/vuln/detail/CVE-2026-50751)
- [Check Point SK185033 — Remote Access / Mobile Access hotfix](https://support.checkpoint.com/results/sk/sk185033)
- [Qilin Ransomware (Agenda): A Deep Dive](https://www.checkpoint.com/cyber-hub/threat-prevention/ransomware/qilin-ransomware/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0718