Qilin affiliate exploited Check Point VPN zero-day since early May; CISA gives agencies three days to patch

Check Point confirmed on June 8 that attackers are exploiting CVE-2026-50751, a critical (CVSS 9.3) authentication bypass in the deprecated IKEv1 key exchange used by its Remote Access VPN, Mobile Access/SSL VPN and Quantum Spark firewalls, and released an emergency hotfix. The logic flaw in certificate validation allows attackers to establish remote-access VPN sessions without a valid user password on gateway versions R80.20.x through R82.10.

Exploitation began as early as May 7 and intensified in early June, with a few dozen organizations targeted globally as of publication. Help Net Security reported that one confirmed incident involved post-compromise activity consistent with Qilin ransomware operations, including data exfiltration using Rclone and communications over the Tox protocol.

CISA added the flaw to its Known Exploited Vulnerabilities catalog the same day, giving federal civilian agencies just three days — until June 11 — to secure devices, one of its tightest KEV deadlines. Check Point also patched CVE-2026-50752, a related man-in-the-middle weakness (CVSS 7.4) in IKEv1 certificate validation with no observed exploitation, and urged customers to audit logs back to May 7 using guidance in support articles SK185033 and SK185035.