Critical Zero-Day Exploited in Check Point VPNs by Qilin Ransomware Gang

Check Point disclosed a critical CVE-2026-50751 zero-day in Remote Access and Mobile Access VPNs (CVSS 9.3) that allows authentication bypass via an IKEv1 certificate validation logic flaw and has been actively exploited since May 7, 2026 by a Qilin ransomware affiliate targeting dozens of organizations; patches and mitigations (including disabling IKEv1 and applying hotfixes) were issued immediately.