Check Point VPN Flaw: Passwords Optional, Apparently
Check Point warned that CVE-2026-50751, a critical flaw affecting Remote Access VPN and Mobile Access deployments using deprecated IKEv1, is being actively exploited. The logic flaw in certificate validation allows unauthenticated attackers to bypass password requirements and establish VPN sessions under specific configurations. Exploitation requires remote access or mobile access enabled, IKEv1 enabled, legacy clients accepted, and no machine certificate requirement. Attacks were observed from May 2026 and increased in June, with links in one case to Qilin ransomware activity.
Check Point has warned customers about an actively exploited VPN vulnerability that can allow attackers to bypass password authentication in certain legacy IKEv1 configurations.
The vulnerability, CVE-2026-50751, affects Remote Access VPN and Mobile Access deployments where IKEv1 is enabled and legacy remote access clients are accepted. Under specific conditions, a logic flaw in certificate validation allows an unauthenticated attacker to establish a VPN session without a valid user password.
That is not what anyone wants from a VPN.
The issue does not automatically give attackers full internal access. Check Point notes that additional post-authentication activity is required to reach internal resources or escalate privileges. However, getting through the VPN door is still a serious problem, especially where segmentation and monitoring are weak.
Exploitation has already been observed, with the earliest activity dating back to May 2026 and a ramp-up in June. In one case, activity was linked to a Qilin ransomware affiliate, which should move this from “we’ll review it later” to “who owns this patch window?”
Organisations should patch affected Check Point gateways, disable IKEv1 where possible, require machine certificates, remove legacy client support and review VPN logs for suspicious sessions.
VPN appliances remain high-value targets because they sit directly on the boundary between the internet and internal networks. Treat them accordingly.