Qilin Affiliate Exploits Check Point VPN Authentication Bypass

Check Point disclosed active exploitation of CVE-2026-50751, a critical authentication bypass in Check Point VPN Remote Access, Mobile Access, and Spark firewalls under specific configurations. The flaw, rated CVSS 9.3, affects systems using the deprecated IKEv1 key exchange path and allows a remote, unauthenticated attacker to establish a VPN session without a valid password. Check Point said suspicious activity was detected on June 4, with the earliest known attacks dating to early May and a rise in activity across multiple jurisdictions in early June; customers were urged to review logs back to May 7 and investigate indicators of compromise.

The company linked at least one confirmed post-compromise intrusion to a Qilin ransomware affiliate, describing a financially motivated attack that used VPS infrastructure and likely relied on Rclone for data exfiltration, with possible use of the Tox protocol for communications. Reporting also noted attempts to retrieve malicious ELF payloads from attacker-controlled infrastructure and warned that related infrastructure may also be probing VPN flaws in products from Palo Alto, Fortinet, and F5. Check Point released hotfixes for CVE-2026-50751 and for CVE-2026-50752, a separate flaw that could enable man-in-the-middle attacks on site-to-site tunnels but had not been observed as weaponized; the vendor advised organizations to apply fixes or disable IKEv1 where possible.