Check Point VPN Zero-Day Under Active Exploitation by Ransomware Operators

Check Point has disclosed active in-the-wild exploitation of a critical authentication bypass vulnerability, tracked as CVE-2026-50751, impacting Remote Access VPN and Mobile Access deployments configured with the deprecated IKEv1 key exchange protocol.

The flaw, assigned a CVSS score of 9.3, allows unauthenticated attackers to establish VPN sessions without valid credentials by exploiting a logic flaw in certificate validation.

While initial access does not automatically grant full network control, it enables threat actors to pivot into post-authentication activity, including lateral movement and privilege escalation.

Check Point VPN Zero-Day

According to Check Point Research, exploitation has been observed since at least May 7, 2026, with a noticeable spike in activity in early June.

The campaign appears highly targeted, affecting dozens of organizations globally. In at least one confirmed incident, post-compromise activity was linked to a Qilin ransomware affiliate, suggesting financially motivated threat actors are leveraging the vulnerability as an initial access vector.

Researchers assess with medium confidence that the operators are aligned with ransomware-driven campaigns and may be reusing infrastructure and techniques seen in attacks targeting VPN products from other vendors such as Fortinet, Palo Alto Networks, and F5.

Technically, CVE-2026-50751 stems from improper certificate validation logic within IKEv1-based VPN authentication flows. Attackers can exploit this weakness to bypass password verification entirely and establish a remote VPN session.

This significantly reduces the barrier to entry for attackers, particularly in environments where IKEv1 remains enabled for legacy compatibility. Check Point has emphasized that the vulnerability only affects configurations using IKEv1, which has long been deprecated due to inherent security weaknesses.

During the investigation, Check Point also identified a secondary vulnerability, CVE-2026-50752 (CVSS 7.4), affecting certificate validation in site-to-site VPN connections using IKEv1.

This flaw could allow man-in-the-middle (MitM) attacks under specific conditions. While no active exploitation of CVE-2026-50752 has been observed, its discovery highlights systemic risks associated with legacy cryptographic protocols and reinforces the need for proactive patching.

Threat intelligence indicates that attackers are leveraging VPS infrastructure hosted by providers such as Kaupo Cloud HK, Shock Hosting, and Vultr.

Notably, some attack infrastructure appears geographically aligned with targeted victims, suggesting operational awareness and potential geo-targeting. Additionally, the Tox protocol has been observed for command-and-control communications, a technique commonly used by ransomware groups to evade detection.

Post-exploitation activity includes attempts to deploy Qilin ransomware payloads, particularly Linux ELF binaries retrieved from attacker-controlled servers.

Organizations are strongly advised to apply the latest security updates from Check Point immediately and to turn off IKEv1 wherever possible. Incident response teams should conduct forensic analysis of VPN logs dating back to early May 2026 to identify suspicious authentication events and unauthorized access.

Indicators of Compromise (IOCs)

Type	Indicator
IP Address	45.77.149[.]152
IP Address	209.182.225[.]136
IP Address	38.60.157[.]139
IP Address	162.33.177[.]101
IP Address	45.76.26[.]42
IP Address	144.208.127[.]155
IP Address	38.54.88[.]201
IP Address	38.54.107[.]167
IP Address	66.42.99[.]200
MD5 Hash	52fda5c1b9704544f32ee98d9060e689
MD5 Hash	51d39aa39478beeac94f2d12f682ecce

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.