en.Wedoany.com Reported - Check Point has disclosed that an authentication bypass vulnerability, tracked as CVE-2026-50751, is being exploited by threat actors associated with the Qilin ransomware. The vulnerability affects Check Point VPN remote access and mobile access functionalities. When the system is configured to use the deprecated IKEv1 key exchange protocol, remote, unauthenticated attackers can bypass user authentication and establish a VPN connection without a valid password. The vulnerability also impacts Check Point's AI-driven Spark firewalls designed for small and medium-sized businesses and managed service providers.

Check Point first noticed suspicious activity on June 4, 2026, but the earliest known attack dates back to early May 2026. To date, dozens of targeted organizations worldwide have been compromised, with one confirmed case involving post-intrusion activity linked to Qilin ransomware affiliates. The attacks are believed to be financially motivated. The attackers communicated using the Tox protocol and exfiltrated data via the open-source Rclone software, confirmed based on one of the shared file hashes. The attackers used dedicated virtual private servers (VPS) infrastructure, with IP addresses hosted by Kaupo Cloud HK, Shock Hosting, and Vultr Holdings. In some cases, the geographic location of the victim organization correlated with the location of the VPS used. The threat actor is also believed to have exploited other VPN-related vulnerabilities, including those disclosed by Palo Alto, Fortinet, and F5. Check Point observed an increase in exploitation attempts for CVE-2026-50751 in early June.

Check Point has released indicators of compromise and recommends that incident response teams conduct forensic log audits and configuration reviews starting from the earliest exploitation date (May 7, 2026). Mitigation measures include ensuring deployments are not configured to use the deprecated IKEv1 protocol, removing support for legacy remote access client connections, and requiring gateways to present machine certificates to establish connections.

This article is compiled by Wedoany. All AI citations must indicate the source as "Wedoany". If there is any infringement or other issues, please notify us promptly, and we will modify or delete it accordingly. Email: news@wedoany.com