Qilin Affiliate Exploiting Check Point VPN CVE-2026-50751 (CVSS 9.3) IKEv1 Auth Bypass as Zero-Day Since May 7 — CISA KEV, Hotfix Available

Check Point disclosed CVE-2026-50751, a logic flaw in IKEv1 certificate validation that allows unauthenticated attackers to establish a VPN session without valid credentials, actively exploited since May 7 with exploitation surging in early June. A Qilin ransomware affiliate is confirmed responsible for at least one post-compromise incident, with observed post-exploitation using Rclone for data staging and the Tox protocol for C2; attacker infrastructure spans VPS providers Kaupo Cloud HK, Shock Hosting, and Vultr. CISA added the flaw to the KEV catalog on June 8 and ordered federal agencies to patch by June 11; defenders should audit VPN logs from May 7 onward and immediately disable IKEv1 or apply the available hotfix.

CISA added the flaw to the KEV catalog on June 8 and ordered federal agencies to patch by June 11; defenders should audit VPN logs from May 7 onward and immediately disable IKEv1 or apply the available hotfix.

This intelligence brief has been compiled from open-source reporting and corroborated across multiple threat intelligence sources. Defenders should treat the critical severity rating as a guide to prioritization within their environment.

For the latest indicators of compromise, formatted SIEM queries, and unredacted actor intelligence related to this brief, DMZ Operator subscribers receive automated IOC packages via email the moment new advisories are published.