A critical authentication-bypass flaw in Check Point’s Remote Access VPN was being exploited as a zero-day for more than a month before anyone outside the attackers knew it existed — and when the disclosure finally came, the U.S. government gave its agencies just three days to slam the door shut.

Check Point confirmed on June 8 that CVE-2026-50751, a near-maximum-severity vulnerability carrying a CVSS score of 9.3, had been weaponized in the wild. A day later, the Cybersecurity and Infrastructure Security Agency (CISA) added the bug to its Known Exploited Vulnerabilities (KEV) catalog and invoked Binding Operational Directive 22-01, setting a remediation deadline of end of day June 11, 2026 for all Federal Civilian Executive Branch agencies. The compressed timeline tells you everything about how seriously the U.S. government is treating this one.

The reason for the urgency: the attacks have a name attached to them. Check Point tied confirmed post-compromise activity to an affiliate of the Qilin ransomware-as-a-service operation — the same crew that topped our May 2026 ransomware report with 646 victims claimed across the month.

A logic flaw in a deprecated protocol

CVE-2026-50751 is not a memory-corruption bug or a flashy remote-code-execution chain. It is an authentication bypass — categorized as improper authentication (CWE-287) — rooted in how Check Point’s Remote Access and Mobile Access components handle the deprecated IKEv1 key-exchange protocol.

In practical terms: gateways configured to accept legacy VPN clients without requiring machine certificates can be tricked into establishing a remote-access VPN connection for an unauthenticated, remote attacker. No credentials. No phishing. No user interaction. Just network access to an exposed gateway and a request crafted to slip past the validation logic.

The flaw affects Mobile Access / SSL VPN, Remote Access VPN, and Spark firewalls across a wide swath of releases — R80.20.x, R80.40, R81, R81.10.x, R81.20, R82, and their point releases. Four of those branches (R80.20.x, R80.40, R81, and R81.10) are already End-of-Support, which means some of the most exposed organizations are running code Check Point no longer maintains.

A companion bug, CVE-2026-50752, covers an IKEv1 certificate-validation weakness that could enable a man-in-the-middle attack on site-to-site connections. There is no evidence that second flaw has been exploited in the wild.

What the timeline shows

Forensic evidence pushes the start of exploitation back to May 7, 2026 — roughly a month before public disclosure. Activity surged in early June, over the weekend immediately preceding the announcement, before Check Point went public on June 8 and CISA moved on June 9.

That month-long head start is the part that should worry defenders. A VPN gateway is, by design, the front door to the internal network. An auth bypass on that gateway hands an attacker a foothold that looks like a legitimate user session, and Qilin affiliates are not known for sitting on access quietly.

Check Point describes the spread as “a few dozen targeted organizations globally,” with victim sectors spanning government, critical infrastructure, healthcare, finance, and manufacturing. That is consistent with Qilin’s opportunistic, broad-net targeting — the group has claimed more than 400 victims since it surfaced in August 2022.

Patch now, or rip it out

Check Point published emergency hotfixes and documented mitigations in support advisory SK185033. The vendor’s guidance for organizations that cannot patch immediately is blunt: disable legacy client support, require IKEv2-only authentication, and mandate machine certificates — all of which break the precondition the exploit relies on.

CISA’s directive language leaves federal agencies three options and no fourth: apply the vendor mitigations, follow BOD 22-01 guidance for cloud-hosted instances, or discontinue use of the product if mitigations are unavailable. The agency urged private-sector organizations to treat the deadline as their own.

For any organization running an exposed Check Point Remote Access or Mobile Access gateway on an affected branch, the action items are immediate:

  • Apply the SK185033 hotfix without waiting for a maintenance window.
  • If patching must be delayed, enforce IKEv2-only and machine-certificate authentication to disable the vulnerable IKEv1 path.
  • Hunt for compromise. A month-long exploitation window means assume-breach is the correct posture — review VPN session logs, look for anomalous remote-access authentications, and check for the lateral-movement and credential-access tooling Qilin affiliates favor.

This is the second consecutive month Qilin has dominated the ransomware conversation. A zero-day on a perimeter security appliance is exactly the kind of high-leverage access the group’s affiliate model is built to monetize — and the three-day federal deadline is a signal that defenders everywhere should be moving at the same speed.

Sources