Check Point VPN Zero-Day Actively Used by Qilin Ransomware — Patch Now

If your business runs Check Point Security Gateway firewalls with Remote Access VPN or Mobile Access, stop reading and go patch. CVE-2026-50751 is a critical authentication bypass flaw rated 9.3 out of 10. It allows attackers to walk straight through your VPN without a valid password by exploiting a logic error in an older key exchange protocol called IKEv1. Exploitation started in early May, ramped up sharply in early June, and CISA ordered federal agencies to patch within three days — one of the shortest deadlines they issue. A Qilin ransomware affiliate has already been linked to at least one confirmed intrusion. The same threat actor is reportedly targeting similar vulnerabilities in Palo Alto and Fortinet products, so this is not a targeted campaign against specific companies — it is opportunistic mass exploitation. Check Point released hotfixes on June 8. If you are running end-of-life gateway versions R81, R81.10, or R80.40, patches are not coming — you need to migrate or isolate. At minimum, disable legacy IKEv1 Remote Access client support and enforce machine certificate authentication today. Review your VPN logs going back to May 7 for suspicious authentication events.