CVE-2026-50752Active Exploitation

🚨 CVE-2026-50752: Certificate Validation Bypass in VPN Site-to-Site Connections Using IKEv1 Critical Vulnerability Alert! Check Point VPN is affected by CVE-2026-50752. Full Vulnerability Details & Analysis at DarkEye: 🔗 https://darkeye.org/vuln/cve/CVE-2026-50752 🔍 Identify Targets via ZoomEye: Filter: vul.cve="CVE-2026-50752" Search Dork: app="Check Point VPN" Exposure: 1.8k instances identified globally. ZoomEye Search Link: 👉 https://www.zoomeye.ai/searchResult?q=YXBwPSJDaGVjayBQb2ludCBWUE4i&t=all&utm_source=twitter&utm_medium=social&utm_campaign=cve_ops_20260609 #Infosec #CyberSecurity #ZoomEye #DarkEye

🚨 Detailed Analysis for CVE-2026-50752 (Certificate Validation Bypass in VPN Site-to-Site Connections Using IKEv1) Stop guessing the risk. The technical details are ready. 🔥 $5 Special Trial to celebrate our CVE Feed launch! 🔗 https://darkeye.org/vuln/cve/CVE-2026-50752 Critical Risk Identified! Affects Check Point VPN. cc: @zoomeye_team (1.8k targets detected 🎯) #CVE202650752 #Infosec #DarkEye #ZoomEye

Critical Check Point VPN zero-day (CVE-2026-50751) exploited in the wild since May 7. Authentication bypass allows unauthenticated VPN access through IKEv1 weakness, linked to Qilin ransomware affiliate targeting dozens of organizations. Key technical details: • CVE-2026-50751: CVSS 9.3 authentication bypass in Remote Access VPN/Mobile Access using deprecated IKEv1 protocol • Logic flaw in certificate validation during IKEv1 key exchange enables session establishment without credentials • Affects R80.20.X through R82.10 (four branches already End of Support) • Related CVE-2026-50752 (CVSS 7.4) enables MITM attacks on site-to-site VPN tunnels Attack infrastructure: • VPS hosts from Kaupo Cloud HK, Shock Hosting, Vultr Holdings • Geographic matching: attacker VPS regions aligned with target locations • Post-exploitation: ELF payload retrieval from C2 servers • IOCs include IPs 45[.]77[.]149[.]152, 209[.]182[.]225[.]136, and MD5 hashes Emergency patching required. Hunt for anomalous VPN sessions from May 7 onward, focus on IKEv1 connections without machine certificates. Full IOC list in Check Point advisory. #DFIR_Radar

Check Point patched CVE-2026-50751, a critical VPN auth bypass used in zero-day attacks, and found CVE-2026-50752, an IKEv1 flaw tied to Qilin ransomware activity. #CheckPoint #Qilin #VPN https://ift.tt/e0lFEuz

Check Point VPN CVE-2026-50751 (CVSS 9.3): Qilin ransomware exploited IKEv1 auth bypass for a month before patch. Second CVE-2026-50752 for site-to-site MITM. Patch now.

@AzRepGillette @MaricopaVote Last couple months... Check Point: CVE-2026-50751, CVE-2026-50752 Palo Alto: CVE-2026-0283 SonicWall: CVE-2026-15409, CVE-2026-15410 Cisco: CVE-2026-20103 (and related) Microsoft (SSTP): CVE-2026-50694 WireGuard (InHand): CVE-2026-38704

0day Intel: 🚨 CVE-2026-50752: Certificate Validation Bypass in VPN Site-to-Site Connections

Full Tweet 🚨 CVE-2026-50752: Certificate Validation Bypass in VPN Site-to-Site Connections Using IKEv1 0day Intel: 🚨 CVE-2026-50752: Certificate Validation Bypass in VPN Site-to-Site Connections

Source: X search for CVE-2026 critical Posted: 2026-06-09T06:54:23.000Z Likes: 23 0day Intel: 🚨 CVE-2026-50752: Certificate Validation Bypass in VPN Site-to-Site Connections

CVE-2026-50752: 🚨 CVE-2026-50752: Certificate Validation Bypass in VPN Site-to-Site Connections Using IKEv1 Critical Vulnerability Alert! Check Point VPN is affected by CVE-2026-50752. Full Vulnerability Details & Analysis at DarkEye: 🔗 🔍…

#threatreport #LowCompleteness Check Point VPN Authentication Bypass Under Active Exploitation | 08-06-2026 Source: https://kudelskisecurity.com/research/cve-2026-50751-check-point-vpn-authentication-bypass-under-active-exploitation Key details below ↓ 🎯Victims: Check point vpn deployments, Vpn infrastructure 🔓CVEs: CVE-2026-50751 \[[Vulners](https://vulners.com/cve/CVE-2026-50751)] - CVSS V3.1: *9.3*, - Vulners: Exploitation: True Soft: - checkpoint gaia_os (<r81.20, r82, r82.10) CVE-2026-50752 \[[Vulners](https://vulners.com/cve/CVE-2026-50752)] - CVSS V3.1: *7.4*, - Vulners: Exploitation: Unknown 🤖LLM extracted TTPs:` T1133, T1190, T1583.003 🧨IOCs: - IP: 9 - Hash: 2 #threatreport: A critical vulnerability, CVE-2026-50751, has been discovered in Check Point Remote Access VPN and Mobile Access products, currently being actively exploited. This authentication bypass vulnerability affects deployments utilizing the deprecated IKEv1 key exchange protocol and has been assigned a CVSS score of 9.3, indicating its severity. The flaw arises from a logical weakness in the certificate validation process during IKEv1-based authentication, allowing attackers to establish VPN sessions without valid user credentials. The vulnerability permits remote attackers to manipulate the authentication flow, thus bypassing necessary checks that would typically prevent unauthorized access. As a result, attackers can initiate and establish connections to the VPN, appearing as legitimate users, which positions them for deeper exploitation within the network. However, while this flaw permits entry via the VPN, it does not grant unrestricted internal access; attackers must still engage in further activities to exploit the network comprehensively. Reports of exploitation show that threat actors are not just achieving VPN access but are also executing additional post-exploitation tactics that resemble targeted intrusion campaigns. These operations have been linked to ransomware activities, and existing evidence suggests that financially motivated groups are utilizing this vulnerability. Attackers have been observed employing externally hosted virtual private servers (VPS) to launch their attempts against exposed VPN endpoints. The strategic alignment of the geographical locations of these servers with victim organizations indicates a methodical targeting approach. In response to this critical vulnerability, it is imperative that organizations upgrade all affected Check Point Security Gateways and VPN components to the latest hotfix versions that address the issue. It is also recommended to revise remote access configurations by enforcing stringent authentication methods and limiting VPN gateway exposure as much as possible. Security teams should undertake threat hunting initiatives by reviewing authentication logs from May 7, 2026, to detect any anomalous session creation that lacks legitimate authentication. Furthermore, monitoring for indicators of compromise is essential, particularly by investigating suspicious outbound connections and correlating logs with known malicious actor infrastructure utilized during attacks.

Check Point VPN のゼロデイ脆弱性 CVE-2026-50751：ランサムウェア攻撃を確認 https://iototsecnews.jp/2026/06/08/check-point-vpn-0-day-vulnerability-exploited-in-the-wild-to-deploy-ransomware/ 一連のインシデントの原因となったのは、CVE-2026-50751 および CVE-2026-50752 に共通する、IKEv1 の証明書検証処理に存在するロジック上の欠陥です。特に CVE-2026-50751 では、認証に関わる検証が適切に行われないことで、有効なパスワードを持たない攻撃者であっても、VPN セッションを確立できる状態となっていました。問題の背景には、すでに非推奨となっている IKEv1 を利用し続けていた環境が存在したことも挙げられます。実際に攻撃者は、この欠陥を悪用して初期侵入を実現し、その後の活動へとつなげていました。VPN は外部から内部ネットワークへ接続する重要な仕組みであるため、認証や証明書の検証処理に不備が生じると、その影響は組織全体に及ぶ可能性があります。ご利用のチームは、ご注意ください。 #CheckPointVPN #CVE202650751 #CyberAttack #Ransomware #Vulnerability

How it works: flaw in IKEv1 key exchange lets attackers establish VPN sessions without valid credentials — no password needed. Related CVE-2026-50752 (CVSS 7.4) enables man-in-the-middle attacks on site-to-site VPN tunnels. Dozens of orgs already confirmed hit. Qilin affiliate identified as primary threat actor.

Check Point disclosed CVE-2026-50751, a critical VPN auth bypass exploited as a zero-day since May 7. Related flaw CVE-2026-50752 also fixed; CISA added the issue to KEV. #CheckPoint #Qilin #KEV https://ift.tt/9kCOUhF

🚨 NEW: CVE-2026-50751 (CVSS 9.3) — Check Point VPN is being actively exploited. Attackers bypass authentication entirely via a logic flaw in certificate validation on IKEv1 setups — no password required. Exploitation started May 7 and has ramped up sharply this month. Qilin ransomware is confirmed in the post-exploitation phase. The same threat actor infrastructure is also hitting Palo Alto, Fortinet, and F5 VPNs. A second flaw (CVE-2026-50752) enabling man-in-the-middle attacks on site-to-site VPNs was also found. Apply Check Point's hotfix immediately and disable IKEv1 if you don't need it. Full breakdown 👇 https://thehackernews.com/2026/06/critical-check-point-vpn-flaw-exploited.html

@WikiLeaksV2 @Qilin so been busy still Exploited a zero-day vulnerability in Check Point VPN CVE-2026-50752 (CVSS 7.4) so when are going to alt ?? https://t.co/TynpI17Fyo

Qilin ransomware affiliates are reportedly weaponizing vulnerable Check Point VPN deployments to gain initial access. CVE-2026-50751 and CVE-2026-50752 affect Check Point Mobile Access, SSL VPN, Remote Access VPN, Spark Firewall, and Security Gateways. Apply the latest hotfixes and reduce exposure with Saner. #CyberSecurity #Ransomware #Qilin #CVE #VPN #VulnerabilityManagement #CheckPoint

#threatreport #LowCompleteness Critical Check Point VPN Zero-Day Exploited in the Wild (CVE-2026-50751) | 08-06-2026 Source: https://www.rapid7.com/blog/post/etr-critical-check-point-vpn-zero-day-exploited-in-the-wild-cve-2026-50751 Key details below ↓ 💀Threats: Qilin_ransomware, Mitm_technique, 🎯Victims: Organizations 🔓CVEs: CVE-2026-50752 \[[Vulners](https://vulners.com/cve/CVE-2026-50752)] - CVSS V3.1: *Unknown*, - Vulners: Exploitation: Unknown CVE-2026-50751 \[[Vulners](https://vulners.com/cve/CVE-2026-50751)] - CVSS V3.1: *Unknown*, - Vulners: Exploitation: Unknown CVE-2024-24919 \[[Vulners](https://vulners.com/cve/CVE-2024-24919)] - CVSS V3.1: *Unknown*, - Vulners: Exploitation: Unknown 🤖LLM extracted TTPs:` T1190, T1557 🧨IOCs: - IP: 9 - Hash: 2 🔢Algorithms: md5 #threatreport: On June 8, 2026, Check Point disclosed a critical authentication bypass vulnerability, CVE-2026-50751, impacting its Remote Access VPN, Mobile Access, and Spark Firewall products. This vulnerability, rated with a CVSS score of 9.3, is particularly significant as it relates to the older IKEv1 key exchange protocol. It allows unauthenticated attackers to establish a VPN session without valid credentials due to a flaw in the validation of certificates during the IKEv1 key exchange process. Organizations using configurations that still accept these legacy Remote Access clients are at high risk. Although attackers can initiate a VPN session, they would require further post-authentication actions to access internal resources or escalate privileges. The exploitation of CVE-2026-50751 has already been observed in the wild, with reports of attacks dating back to May 7, 2026, and an uptick in activity noted in early June. This campaign has primarily targeted dozens of organizations, with notable affiliations to cyber criminal entities, including a Qilin ransomware affiliate. Rapid7 has confirmed at least one incident tied to this vulnerability with a high confidence level. In addition to CVE-2026-50751, Check Point identified a related flaw, CVE-2026-50752, which has a CVSS score of 7.4. This vulnerability could allow man-in-the-middle attacks on site-to-site VPN configurations, but no exploitation has been detected for this issue as of now. In light of these vulnerabilities, it is crucial for organizations utilizing Check Point products to promptly apply the hotfixes released for CVE-2026-50751, given the active exploitation. Check Point advises affected entities to eliminate support for legacy remote access clients, configure global properties to require IKEv2 authentication exclusively, mandate machine certificate authentication, and enable Intrusion Prevention System (IPS) features while ensuring that the latest signatures are downloaded. Organizations should not delay applying these updates and should prioritize their implementation to safeguard against emerging threats.

CVE-2026-50751 · Ransomware · Zero-Day 🚨 Check Point links active VPN zero-day attacks to the Qilin ransomware gang. Attacks exploiting CVE-2026-50751 — a critical auth bypass in Check Point Remote Access VPN via deprecated IKEv1 protocol — began May 7, surged in early June, and have hit a few dozen organisations globally. A second flaw, CVE-2026-50752, enables man-in-the-middle attacks on site-to-site VPN connections — no in-the-wild exploitation yet, but patches are strongly advised. Patch both CVEs immediately.

Check Point says CVE-2026-50751 is actively exploited to bypass auth in deprecated IKEv1 VPN setups, affecting Remote Access and Mobile Access deployments. CVE-2026-50752 may enable AitM attacks. #CheckPoint #Qilin #VPN https://ift.tt/cBYhnC6