Skip to content
All posts

· by NetProtector Security Team

Check Point VPN: Login Without a Password via Deprecated IKEv1

Illustration: An old IKEv1 key opens the modern VPN lock, no password required

Old protocols often remain active for one single reason: some older client still needs them. At Check Point, that is exactly what is now becoming an entry point. Through the vulnerability CVE-2026-50751, attackers establish a Remote Access VPN connection without knowing a valid password – provided the gateway still permits the deprecated IKEv1 key exchange protocol. Check Point disclosed the vulnerability on June 8, 2026, and has observed attacks since May 7. In at least one case, an affiliate of the Qilin ransomware group was behind it. The US agency CISA added the vulnerability to its catalog of known exploited vulnerabilities on the same day.

What It Is About

The flaw lies in certificate validation during the IKEv1 key exchange for Remote Access VPN and Mobile Access. A logic error causes the gateway to permit a VPN connection without the user having authenticated with a valid password. According to Check Point, the attacker then needs further steps to access internal resources or escalate privileges – but the VPN connection itself is established.

Key facts according to Check Point advisory sk185033:

  • Severity: CVSS 9.3 (critical).
  • Affected: Security Gateways running R81.20, R82 and R82.10 as well as the no longer supported versions R80.40, R81 and R81.10; also Spark firewalls running R80.20.X, R81.10.X and R82.00.X. A gateway is only vulnerable if all of these conditions apply: Remote Access VPN or Mobile Access is enabled, IKEv1 is permitted for Remote Access, the gateway accepts legacy Remote Access clients, and it does not require a machine certificate.
  • Fixed in: hotfixes that Check Point provides for the supported versions. Which package matches which version is listed in sk185033.
  • Prerequisite for the attack: a gateway reachable from the internet with the described configuration. The attacker does not need credentials.
  • Consequence: a VPN session without a valid password – in other words, access to the network involving neither a password nor any additional authentication factors.

During its investigation, Check Point found a second vulnerability in the same protocol: CVE-2026-50752 (CVSS 7.4) may, under certain circumstances, enable man-in-the-middle attacks on site-to-site VPN connections. No exploitation has been observed so far.

Why This Is Urgent

According to Check Point, the attacks began no later than May 7, 2026, and increased in early June. According to the vendor, "a few dozen" specifically targeted organizations worldwide are affected. Check Point assesses with medium confidence that a financially motivated actor deploying Qilin ransomware is responsible. After gaining VPN access, the attackers attempted to download Linux malware from their own servers.

The infrastructure is revealing: the attacks came from rented virtual servers at hosting providers, some in the same country as the victim. According to Check Point's assessment, the same infrastructure is also used to exploit published vulnerabilities in other vendors' VPN products. So this is not an attack on a single product, but on VPN access as such – regardless of who supplies it.

For Check Point customers, the pattern is not new. Back in May 2024, CVE-2024-24919 (CVSS 8.6) affected gateways with Remote Access VPN or Mobile Access: attackers could read files from the gateway, including password hashes of local accounts. The security company mnemonic observed attacks starting April 30, 2024. There too, older accounts that authenticate with a password only were particularly at risk. The lesson from both cases: whatever remains active only for compatibility reasons will sooner or later become a target.

What You Should Do Now

  1. Install the hotfix. Install the appropriate hotfix from sk185033 as soon as possible. Gateways running unsupported versions should be migrated to a supported version.
  2. Disable legacy methods if the hotfix cannot be applied immediately: stop allowing legacy clients, restrict Remote Access VPN to IKEv2 in the global settings, and make machine certificates mandatory. Check beforehand which clients and use cases still depend on IKEv1.
  3. Enable IPS and load the latest signatures. This helps with detection but does not replace the hotfix.
  4. Review logs from May 7 onward. Compare connections against the IP addresses in Check Point's list of indicators – it has been expanded several times since publication. Look for VPN sessions with unknown users or unusual source IPs.
  5. If in doubt, assume compromise: terminate sessions, reset credentials, and check whether files were downloaded from the gateway or internal systems were contacted. Check Point offers support for this.

What This Means for Protecting Firewalls

CVE-2026-50751 reveals an uncomfortable side of network security: with its VPN access, the firewall itself is a publicly reachable service. A vulnerability there undermines all the rules and authentication methods built behind it. In this case, about a month passed between the first attack and the hotfix.

NetProtector adds its own protective layer to the firewall at exactly this point. The appliance is placed inline in front of the firewall and assesses traffic before it reaches the VPN gateway:

  • Known attacker sources stay out. Attacks like this one run via servers that the same actors use again and again against different targets. Addresses already identified as attackers in the NetProtector sensor network are blocked before they can reach your gateway.
  • Suspicious activity becomes visible. NetProtector detects scans for VPN services, repeated connection attempts or atypical access patterns as anomalies. Alerts can be forwarded to existing systems such as your SIEM or ticketing system, so your security team sees them where it already works.
  • An additional layer, not a replacement. NetProtector replaces neither the hotfix nor the configuration change, and it does not undo an attacker session that has already been established. It does, however, reduce the attacks that reach the gateway at all in the time until the patch.
Automated response
Optional playbooks for detected threats
ContainBlock suspicious connections, isolate affected systems.
Preserve evidenceCollect logs and packet captures for analysis.
RemediateBlock C2 servers, quarantine malware.
RecoverSupport the return to safe normal operations.
Integrations
Fits into your existing security stack
SIEMAlerts via syslog, CEF or STIX/TAXII
SOARREST API and webhooks for playbooks
EDR / XDRContext for endpoint protection
Firewall systemsAdjust rules in real time
TicketingIncidents become tickets automatically
Dashboard & reportsReal-time situation and management reports

Which responses NetProtector can automate and how it fits into existing security tools is explained on our page How NetProtector works.

Our Assessment

This case is less a question of the vendor than a question of legacy baggage. IKEv1 has been considered deprecated for years, yet it remains active in many networks because some older client somewhere still depends on it. Every such exception is attack surface. Anyone who wants to protect their VPN access should therefore regularly review which protocols and authentication paths are actually needed, apply updates promptly, monitor logins – and add a layer in front of the firewall that keeps known attackers from even reaching the gateway.

Sources