Israeli cybersecurity firm Check Point issued security updates to fix a serious flaw impacting Remote Access VPN and Mobile Access deployments that threat actors leveraged during zero-day campaigns.

Assigned CVE-2026-50751, the issue lets unauthenticated remote attackers bypass authentication on targeted Mobile Access or SSL VPNs, Remote Access VPNs, or Spark firewalls and set up a remote access VPN link.

The company noted that the flaw impacts only setups using the outdated IKEv1 key exchange protocol along with security gateways that allow legacy Remote Access clients and skip machine certificate requirements for connections.

Attacks started on May 7, rose sharply in early June, and hit just a few dozen organizations worldwide, including at least one case connected to the Qilin ransomware group.

Check Point Research confirmed active exploitation of CVE-2026-50751, a critical authentication bypass issue in Check Point Remote Access VPN and Mobile Access deployments that rely on the deprecated IKEv1 key exchange protocol.

Observed activity stayed limited to a few dozen targeted organizations globally, with one incident showing confirmed follow-on actions tied to a Qilin ransomware affiliate. Customers still running the IKEv1 protocol should install the available security updates without delay.

Check Point also outlined temporary steps for organizations unable to patch right away, including dropping support for the legacy remote access client, limiting Remote Access VPN Authentication to IKEv2 only, requiring Machine Certificate Authentication, and turning on IPS with the latest signatures.

During the investigation into CVE-2026-50751, researchers uncovered a second flaw tracked as CVE-2026-50752 that affects certificate validation in the deprecated IKEv1 protocol and could enable man-in-the-middle attacks against site-to-site VPN links.

Although no in-the-wild exploitation of CVE-2026-50752 has been seen yet, the company urged customers to apply updates to reduce possible risk.

Qilin first appeared in August 2022 as a Ransomware-as-a-Service operation originally called Agenda and has since listed nearly 400 victims on its dark web leak site.

High-profile targets claimed by the group include automotive supplier Yangfeng, Nissan, Japanese brewer Asahi, publisher Lee Enterprises, pathology provider Synnovis, and Australia's Court Services Victoria.