Critical alert: CVE-2026-50751 puts VPNs of Check Point at risk of access without credentials; disables IKEv1 and applies patches already

Check Point has warned about the active exploitation of critical vulnerability that affects implementation of Remote Access VPN and Mobile Access when configured with the IKEv1 key exchange protocol, which has been obsolete for years. The failure, recorded as CVE-2026-50751(CVSS 9.3), is a weakness in the logical flow of validation of certificates that can allow a remote unauthenticated attacker omit user authentication and set a VPN session without the valid password. Although the connection may require additional steps to access domestic remedies, the mere possibility of entry without credentials is a serious risk vector for the perimeter security of an organization.

The products concerned include several branches of Security Gateways and Spark Firewalls in specific versions that are still in use in business environments. The actor abused specific conditions: the remote VPN or Mobile Access service must be enabled, IKEv1 must be allowed, gateways must accept inherited remote customers and not require a machine certificate for connections. Check Point indicated that it observed suspicious activity since early May 2026 and that the attacks intensified in June, targeting a "few hundred" of global organizations, with at least one case related to a Qilin Ransomware affiliate.

This incident highlights two technical and strategic issues. Technically, IKEv1 is already insecure and has been replaced by IKEv2 which fixes many design gaps and offers better authentication and protection options against intermediary attacks. In strategic terms, the recurrence of corporate VPN device abuses shows that attackers prioritize initial access vectors that allow persistence and lateral movement, taking advantage of VPS infrastructure to geolocalize attacks and minimize traceability.

The immediate actions to be taken by security officials are clear: first, disable IKEv1 on all platforms where possible and force IKEv2; second, require machine certificates in addition to user credentials for VPN connections; and third, apply the patches and hotfixes to publish Check Point for affected versions or update to versions that no longer contain vulnerability. It is essential to coordinate these measures with tests in laboratory environments and maintenance windows because changes in VPN configuration can interrupt legitimate remote access.

Beyond patching and reconfiguring, I recommend activating compensatory controls: boost the use of MFA for VPN accesses, segmenting networks to limit what successful access can achieve, restricting remote administration by reliable PIs, and fully recording VPN telemetry to detect abnormal sessions. Threat hunting should include searches for established connections without corresponding user authentication, ELF binary download attempts from attacker-controlled infrastructure and associated communication patterns such as the use of the Tox protocol, which Check Point associated with Ransomware-type actors.

In addition to CVE-2026-50751, another vulnerability was identified during the review, CVE-2026-50752(CVSS 7.4), which could allow an adversary in half (AitM) to affect VPN connections site-to-site; there is currently no public evidence of actual exploitation of this second failure, but its existence reinforces the need to review configurations and apply deep defence principles.

For incident response teams: if they suspect engagement, they should isolate suspicious sessions, preserve login and artifacts from the gateways, and evaluate detection rules for side movements and malicious downloads. Contact the supplier to obtain specific mitigation indications and receive IOCs is essential. It is also appropriate to review the possibility that the actor has used geolocalized VPS to attack organizations within a particular country, as this may guide the prioritization of threat hunting.

Organizations that want to deepen technical information and confirm available patches can consult the manufacturer's resources and public vulnerability databases, for example the Check Point research page and the official entry into the NVD base: Check Point Research and NVD CVE-2026-50751 record. Implement the corrections, tighten VPN configurations and launch detection and response controls significantly reduces the risk of this failure becoming a major gap.

In short, the combination of a logical vulnerability in the validation of certificates and the persistence of inherited configurations like IKEv1 has created an attack window exploited by financially motivated actors. The urgent remediation (patch and disable IKEv1) and a holistic review of the VPN position are the immediate priorities for any organisation using the products concerned.