CVE-2026-50751: Check Point VPN — Remote Auth Bypass Enables Ransomware (June 2026)

CVE-2026-50751 — Check Point Remote Access VPN

CVE-2026-50751 is a critical authentication bypass vulnerability in Check Point Remote Access VPN and Mobile Access products. With active exploitation confirmed since early May 2026, attackers have leveraged this flaw to gain remote, unauthenticated access to VPN gateways, bypassing all credential checks. The vulnerability is being used in ransomware campaigns, including at least one incident attributed to a Qilin ransomware affiliate.

Attack Vector

Attackers exploit CVE-2026-50751 by sending crafted authentication requests to exposed VPN endpoints. No valid credentials are required; successful exploitation grants direct access to internal network resources behind the VPN. This enables lateral movement, data exfiltration, and deployment of ransomware payloads. Indicators of compromise include anomalous VPN logins from unfamiliar IP addresses and unexpected administrative actions on the VPN gateway.

Who Is at Risk

All organizations running unpatched Check Point Remote Access VPN and Mobile Access products are at risk, regardless of deployment size or sector. The campaign has targeted a few dozen organizations globally, with confirmed exploitation by ransomware affiliates. Any internet-exposed Check Point VPN gateway should be considered vulnerable until patched.

Patch & Mitigate

• Patch: Apply Check Point's official security updates for Remote Access VPN and Mobile Access products immediately. Refer to vendor advisories for exact version numbers and patch instructions.
• Workaround: If patching is not immediately possible, restrict external access to VPN endpoints and monitor for suspicious activity.
• Detect: Review VPN logs for unauthorized access attempts, especially successful logins from unknown IPs or unusual geolocations. Monitor for changes to VPN configuration and unexpected privilege escalations.

MITRE ATT&CK

• TA0001 — Initial Access: Attackers exploit the VPN to gain a foothold in the network.
• TA0005 — Defense Evasion: Authentication bypass allows adversaries to avoid detection and logging tied to valid credentials.
• TA0007 — Discovery: Once inside, attackers enumerate internal resources for further compromise.

Source: https://www.helpnetsecurity.com/2026/06/12/cve-2026-50751-poc-exploit/