Ransomware crims got a month-long head start on Check Point VPN 0-day that now has a fix

Check Point released an emergency hotfix for a critical authentication-bypass zero-day (CVE-2026-50751) in its Remote Access and Mobile Access VPN products after observing exploitation beginning May 7; investigators tied at least one compromise to a Qilin ransomware affiliate. A second related issue (CVE-2026-50752) affecting IKEv1 certificate validation was also identified, and Check Point published mitigations and indicators of compromise (attacker IPs, certificate subjects) for customers to hunt for suspicious VPN authentication attempts.