CVE-2026-50751 Critical VPN Vulnerability

Check Point Software Technologies has released new details about the active exploitation of the critical vulnerability CVE-2026-50751, which affects certain configurations of VPN Remote Access and Mobile Access products that use the older IKEv1 protocol. The vulnerability, with a severity rating of 9,3/10, has already been exploited in real-world attacks against organizations worldwide, and in at least one case, post-breach activity has been linked to an affiliate of the Qilin ransomware group.

The vulnerability allows attackers to bypass authentication by exploiting an error in certificate validation, creating a VPN session without using a valid password.
Although exploitation may provide initial access to the network, further escalation of rights is required to cause substantial damage.

See more articles from iGuRu.gr when you search for news on Google.

iGuRu.gr preferred source

Check Point's research, which began on June 4, shows that incidents remain limited and targeted, affecting a few dozen organizations worldwide. However, researchers observed an increase in exploitation attempts in early June, making it critical to promptly apply available patches.
According to the findings, the same attacker infrastructures appear to be exploiting other known VPN vulnerabilities that have been published by companies such as Palo Alto Networks, Fortinet, and F5.

WHAT ORGANIZATIONS SHOULD DO

Check Point has already released a comprehensive fix that prevents the exploitation of the vulnerability and it is recommended that all organizations install it immediately.
At the same time, through the BLAST artificial intelligence code security platform, a second vulnerability (CVE-2026-50752, CVSS 7.4) was identified, which also concerns IKEv1 and could, under certain conditions, allow man-in-the-middle attacks on site-to-site VPN connections. Although no incidents of its exploitation have been recorded to date, Check Point recommends the immediate implementation of the relevant updates to proactively mitigate the risk.

MORE INFORMATION
More technical information, suspicious IPs, and clues can be found in the following security knowledge base articles:

https://support.checkpoint.com/results/sk/sk185033
https://support.checkpoint.com/results/sk/sk185035

newsbot

Although the press releases will range from very select to rare, I said I'd pass...because sometimes the editors hide.