Check Point
Israeli network-security vendor; its Remote Access VPN carried CVE-2026-50751, a CVSS 9.3 auth bypass exploited a month before the June 2026 hotfix.
US authorities listed two Check Point flaws rated 9.8 as exploited on 22 September, months after attackers had used a separate VPN authentication bypass for roughly 30 days before its hotfix.
Last refreshed: 22 October 2026 · Appears in 1 active topic
If clients can self-assess their own credentials in Check Point's VPN, how many other gateway products share the same design flaw?
Timeline for Check Point
Mentioned in: BeyondTrust tool hit before its advisory
Cybersecurity: Threats and DefencesDisclosed two exploited flaws and shipped Takes 166 and 170
Cybersecurity: Threats and Defences: Two 9.8 Check Point flaws hit firewallsMentioned in: PaperCut print servers under active attack
Cybersecurity: Threats and DefencesMentioned in: Qilin's own affiliate now outposts it
Cybersecurity: Threats and DefencesSharePoint stays under active KEV fire
Cybersecurity: Threats and DefencesBackground
Check Point is an Israeli network-security vendor. Its products include Remote Access VPN, Spark firewalls and management servers. These systems handle remote connections and security administration, which gives flaws in them direct importance for customer access controls.
The company's 2026 record includes three exploited vulnerability disclosures across those product groups. On 8 June, it disclosed CVE-2026-50751, a Remote Access VPN authentication bypass rated 9.3. Attackers had used the flaw for about a month before the hotfix, and the US Cybersecurity and Infrastructure Security Agency gave federal bodies three days to apply it.
US authorities added two further Check Point flaws, each rated 9.8, to their exploited list on 22 September. One affected Spark firewalls and the other management servers, requiring separate updates. The pattern makes patch speed across distinct Check Point products part of the same operational risk.
Attackers keep exploiting Check Point gateways
Check Point disclosed on 8 June that attackers had exploited a Remote Access VPN authentication bypass for roughly 30 days before a hotfix shipped. The logic flaw let attackers using a deprecated IKEv1 path certify their own credentials as valid. A Qilin ransomware affiliate had reached at least one victim.
On 22 September, US authorities listed two more Check Point flaws as exploited and gave federal agencies until 25 September to fix them. One affected Spark firewalls through data sent during remote-connection setup. The other reached management servers over port 19009, so customers needed separate updates. For Check Point, the incidents put repeated exploitation inside products intended to control access at the network edge.
What is CVE-2026-50751 in Check Point VPN?
Is Check Point Research the same as Check Point Software?
How did a Qilin ransomware affiliate get in through the Check Point VPN flaw?
Why was the CISA deadline for the Check Point VPN patch only three days?
How do I apply the Check Point Remote Access VPN hotfix for CVE-2026-50751?
Written with AI from Lowdown's published reporting. Not individually reviewed by an editor. Updated 22 October 2026. Editorial standards.