Check Point VPN zero-day exploited by Qilin ransomware, patch now

Check Point has rushed out a fix for a critical flaw in its Remote Access VPN, Mobile Access, and Spark firewall products that attackers have been exploiting since May 7. The bug (CVE-2026-50751, rated 9.3) is a logic error in how the software checks certificates, letting an unauthenticated attacker log into the VPN with no password, but only on gateways still using the old IKEv1 key-exchange protocol. So far a few dozen organizations have been hit, and at least one intrusion was tied to an affiliate of the Qilin ransomware gang, which used the access to steal data with Rclone before deploying ransomware. A second, unexploited flaw was also patched.

Check

Check whether your Check Point gateways accept IKEv1 remote-access connections, then audit VPN and authentication logs back to May 7 for logins lacking a matching certificate or password.

Affected

Check Point Remote Access VPN, Mobile Access, and Spark firewalls on versions R80.20.X through R82.10 configured for the deprecated IKEv1 protocol without mandatory machine certificates.

Fix

Apply the hotfix per Check Point advisory SK185033, or switch Remote Access to IKEv2 only, make machine-certificate authentication mandatory, drop legacy clients, and enable IPS signatures.