{"id":228736,"date":"2026-06-09T12:08:00","date_gmt":"2026-06-09T16:08:00","guid":{"rendered":"https:\/\/testing.news-you-need.com\/index.php\/2026\/06\/09\/check-point-warns-of-zero-day-flaw-targeted-by-ransomware-affiliate\/"},"modified":"2026-06-09T12:15:25","modified_gmt":"2026-06-09T16:15:25","slug":"check-point-warns-of-zero-day-flaw-targeted-by-ransomware-affiliate","status":"publish","type":"post","link":"https:\/\/testing.news-you-need.com\/index.php\/2026\/06\/09\/check-point-warns-of-zero-day-flaw-targeted-by-ransomware-affiliate\/","title":{"rendered":"Check Point warns of zero-day flaw targeted by ransomware affiliate"},"content":{"rendered":"

Check Point warns of zero-day flaw targeted by ransomware affiliate<\/a><\/p>\n

https:\/\/www.cybersecuritydive.com\/news\/check-point-zero-day-ransomware\/822372\/<\/a><\/p>\n

Publish Date: 2026-06-09 12:08:00<\/a><\/p>\n

Source Domain: www.cybersecuritydive.com<\/a><\/p>\n

Author: <\/a><\/p>\n

Using an unordered list, summarize the following article with between 4 and 8 key points. <\/p>\n

A critical authentication bypass flaw in Check Point Remote Access VPN and Mobile Access deployments has been under exploitation for more than a month, according to a\u00a0blog post published Monday by Check Point Research.\u00a0
\nThe vulnerability, tracked as CVE-2026-50751, is related to a logic flaw in certificate validation, according to the report. If successfully exploited, the flaw allows an attacker to establish a VPN session without the need for a password.\u00a0
\nDiscovering suspicious activity, Check Point began investigating on Thursday.\u00a0 It found threat activity dating back to May 4. Researchers urge security teams to prioritize forensic log audits and configuration reviews.
\nThe VPN vulnerability is found in deployments that are configured for the deprecated Internet Key Exchange v1 protocol.\u00a0<\/p>\n

Forensic evidence
\nSo far, the investigation has identified a few dozen targeted organizations across the globe. In one specific case, post-compromise activity was linked to an affiliate of Qilin ransomware. The same infrastructure has been observed targeting VPN vulnerabilities in Palo Alto Networks, F5 and Fortinet, according to researchers.
\nThe Cybersecurity and Infrastructure Security Agency on Monday added CVE-2026-50751 to its Known Exploited Vulnerabilities catalog.\u00a0
\nDuring the investigation, Check Point found a second vulnerability, tracked as CVE-2026-50752. The flaw affects certificate validation in deprecated IKEv1 key exchange. This could enable man-in-the-middle attacks that might impact site-to-site VPN communication if certain conditions are met. Check Point has not seen any exploitation of the second vulnerability.
\nCheckPoint is urging upgrades to a hotfix. In addition, the company released security guidance to address the vulnerabilities, along with mitigation steps.\u00a0
\nResearchers from Rapid7 confirmed they have observed at least one case involving CVE-2026-50751.\u00a0
\nResearchers noted that of the nine total version branches of products impacted by the zero-day flaw, four of those products have reached out-of-service status and are no longer under support by Check Point.\u00a0<\/p>\n

<\/p>\n","protected":false},"excerpt":{"rendered":"

Check Point warns of zero-day flaw targeted by ransomware affiliate https:\/\/www.cybersecuritydive.com\/news\/check-point-zero-day-ransomware\/822372\/ Publish Date: 2026-06-09 12:08:00…<\/p>\n","protected":false},"author":1,"featured_media":228737,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"https:\/\/imgproxy.divecdn.com\/WGUPY79LEktvH4NBkYMET1Bmh25ayeqkGTV8rAjjwCw\/g:ce\/rs:fit:770:435\/Z3M6Ly9kaXZlc2l0ZS1zdG9yYWdlL2RpdmVpbWFnZS9HZXR0eUltYWdlcy04MTc0ODYwMjguanBn.webp","fifu_image_alt":"","footnotes":""},"categories":[15],"tags":[24,27],"class_list":["post-228736","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity","tag-cybersecurity","tag-vulnerability"],"_links":{"self":[{"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/228736"}],"collection":[{"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/comments?post=228736"}],"version-history":[{"count":1,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/228736\/revisions"}],"predecessor-version":[{"id":228738,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/228736\/revisions\/228738"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/media\/228737"}],"wp:attachment":[{"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/media?parent=228736"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/categories?post=228736"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/tags?post=228736"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}