CVE-2026-50751: Check Point VPN — Authentication Bypass Enables Ransomware (May 2026)

CVE-2026-50751 — Check Point VPN

CVE-2026-50751 is a critical authentication bypass vulnerability in Check Point VPN and firewall products, rated critical and actively exploited in the wild since May 7, 2026. Attackers can establish VPN sessions without valid credentials, enabling ransomware deployment and data compromise. The US CISA has added this CVE to its Known Exploited Vulnerabilities catalog, underscoring urgent risk.

Attack Vector

Attackers exploit CVE-2026-50751 by sending crafted authentication requests to vulnerable Check Point VPN endpoints. The flaw allows bypassing password checks, granting unauthorized access to internal networks via VPN. Once inside, threat actors—specifically a Qilin ransomware affiliate—move laterally and deploy ransomware, encrypting data and disrupting operations. No prior access or credentials are required; exploitation is remote and pre-authentication.

Who Is at Risk

All organizations running unpatched Check Point VPN and firewall appliances are at immediate risk. The campaign has targeted several dozen global organizations, with confirmed compromise in environments where VPN access is exposed to the internet. Both enterprise and government deployments are affected. Check Point customers should assume exposure if patching has not occurred since May 2026.

Patch & Mitigate

• Patch: Apply Check Point’s official security update for CVE-2026-50751 and CVE-2026-50752 immediately. Refer to Check Point’s advisory for exact versions and hotfixes.
• Workaround: Temporarily restrict VPN access to trusted IPs and disable internet-facing VPN portals until patched.
• Detect: Review VPN logs for anomalous logins, especially successful authentications without corresponding valid credentials, and monitor for lateral movement or ransomware indicators.

MITRE ATT&CK

• TA0001 — Initial Access: Attackers exploit exposed VPN endpoints to gain a foothold.
• TA0005 — Defense Evasion: Authentication bypass allows evasion of standard access controls.

Source: https://www.securityweek.com/check-point-vpn-zero-day-exploited-in-qilin-ransomware-attacks/