The security software provider Check Point is warning of attacks on a security vulnerability in the company's VPN software. It classifies the vulnerability as a critical security risk and speaks of a need for action on the part of IT managers.
In a blog post, Check Point discusses the vulnerability and announces details the attacks. The company warns that it has observed attacks on a critical vulnerability that allows authentication bypass ( CVE-2026-50751 , CVSS 9.3 , risk “ critical ”). The key exchange after the outdated IKEv1 reveals a logic error in Check Point Remote Access and Mobile Access during certificate verification. Unauthenticated malicious actors from the network can exploit this to bypass authentication and establish a VPN connection without a valid password. The Federal Office for Information Security (BSI) also issued a warning on Tuesday morning and names Check Point Remote Access VPN, Mobile Access, and Spark Firewall as affected software.
Check Point observed suspicious activities on Thursday of last week, June 4, 2026. The investigation revealed that the vulnerability had already been attacked since May 7, 2026. At the beginning of June, the attack attempts increased, Check Point further explains.
With medium confidence, Check Point attributes the attacks to the financially motivated ransomware gang Qilin, which apparently uses the “Tox protocol” for attacks. The attacks originated from a virtual private server (VPS) infrastructure. The attackers also chose VPS located near the attack targets, thus attacking targets in Taiwan from a Taiwanese infrastructure. After successful attacks, IT security researchers also found Qilin ransomware binaries and observed download attempts of malicious ELF files from attacker-controlled infrastructure. Check Point believes that Qilin is also behind the observed attacks on VPNs from Palo Alto Networks or Fortinet FortiClient EMS .
As a countermeasure, Check Point mentions software updates but also includes a reference to disabling support for outdated remote access client connections in the instructions for updating affected software .
At the end of the blog post, there are references to attacks (Indicators of Compromise, IOC) that administrators can use to investigate their systems for attack attempts. During the investigation of the attacked vulnerability, IT security researchers also noticed another security-relevant error, CVE-2026-50752 (CVSS 7.4 , risk “ high ”). It is a similar error that attackers can exploit in a man-in-the-middle position to intercept or modify VPN traffic. An update guide is also available for this.
This article was originally published in German . It was translated with technical assistance and editorially reviewed before publication.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
