User Authentication Bypass in VPN Remote Access and Mobile Access (CVE-2026-50751)

What is affected, what to do

This vulnerability allows an unauthenticated remote attacker to bypass authentication and establish a VPN connection without a valid password, affecting the IKEv1 key exchange logic in Check Point Security Gateway. It is actively exploited in ransomware campaigns since 2026. Affected products include versions r80.40 to r81.20 of Check Point Security Gateway. Immediate patching to the latest version is critical to mitigate the risk.

The vulnerability is being actively exploited; treat it as a priority. CISA lists it as used in ransomware campaigns. The available sources name no fixed version. Check the vendor guidance in the references below. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• Check Point Quantum Security Gateway eq R82.10 with Jumbo Hotfix Take 19 or below..R82.10 with Jumbo Hotfix Take 19 or below
• Check Point Quantum Security Gateway eq R82 with Jumbo Hotfix Take 103 or below..R82 with Jumbo Hotfix Take 103 or below
• Check Point Quantum Security Gateway eq R81.20 with Jumbo Hotfix Take 141 or below..R81.20 with Jumbo Hotfix Take 141 or below
• Check Point Quantum Security Gateway eq R81.10, R81, and R80.40..R81.10, R81, and R80.40
• Check Point Spark Firewalls eq R80.20.X, R81.10.X, and R82.00.X..R80.20.X, R81.10.X, and R82.00.X

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Inventory exposed gateways: Identify every Check Point Security Gateway (Gaia OS R80.40 through R81.20) with the Remote Access VPN or Mobile Access blade enabled that offers IKEv1 to the internet (UDP 500/4500, Visitor Mode over TCP 443). These come first.
   • Apply the vendor hotfix: Patch available from the vendor — look up the exact version in the vendor advisory (Check Point Support Center sk article for CVE-2026-50751). Deploy the matching Jumbo Hotfix or hotfix via CPUSE. For clusters, patch the standby member first, then fail over.
   • Disable IKEv1 for remote access now if the patch cannot land within hours. In SmartConsole, enforce IKEv2-only for remote access clients in the Remote Access community or gateway properties. First confirm that no legacy clients or site-to-site peers still depend on IKEv1.
   • Review and purge active VPN sessions: Compare currently connected remote access users (vpn tu, logs) against expected users. Kill unknown or implausible sessions and preserve their Office Mode IPs for forensics.
   • Assume compromise on any anomaly: If suspicious sessions are found, treat everything reachable from them as potentially compromised. Open an incident, keeping the NIS2 early-warning deadline (24 h) in mind. Rotate service account and domain admin credentials that were reachable from the VPN segment.
2. 02

   Runbook step 2

   Mitigation layers

   • Configuration: Permanently retire IKEv1 for remote access, since it is a deprecated protocol. Require a second factor (MFA via RADIUS/SAML) in addition to certificate authentication, so a bypassed certificate check alone does not grant access.
   • Network segmentation: Put the Office Mode IP pool in its own zone and allow only explicit Access Role / Identity Awareness rules to the services users actually need. Never use a blanket "VPN → internal any" rule. Restrict RDP/SMB/LDAP/WinRM from the VPN pool to dedicated jump hosts.
   • Perimeter filtering: Where feasible, limit remote access by geo-blocking or source allowlists (e.g. EU only). Allow IKE on UDP 500/4500 only from known site-to-site peers once remote clients run on IKEv2 or Visitor Mode.
   • IPS / Threat Prevention: Enable the Check Point IPS protection for this CVE in Prevent mode as soon as it ships in the update package. Have upstream IDS (Suricata) alert on IKE Phase 1 negotiations using IKEv1 major version from unknown sources.
   • Least privilege / IAM: Trim remote access groups to what is needed and remove stale user and certificate objects. Audit the internal CA certificates issued to VPN users and revoke unneeded or suspect certificates (refresh the CRL).
3. 03

   Runbook step 3

   Detection rules

   • Check Point VPN logs (SmartLog / Log Exporter → SIEM): Remote access logins over IKEv1 with no preceding successful authentication event (password/MFA). Also logins with unknown or odd certificate DNs. SPL shape: index=checkpoint product="VPN-1*" (action="Log In" OR "Key Install") ike_version=1 | stats count by src, user, office_mode_ip
   • Session anomalies: The same user connected concurrently from multiple source IPs or countries, off-hours logins, and first-seen source ASNs (VPS/hosting providers). Cross-check against HR and leave status.
   • Network telemetry (Zeek/Suricata): conn.log entries for UDP 500/4500 to the gateway from sources that are not known site-to-site peers. Also bursts of IKEv1 Main or Aggressive Mode negotiations from internet IPs (scanning or spraying pattern).
   • Lateral movement from the VPN pool: Windows Event IDs 4624 (logon type 3/10) and 4625 with source IPs from the Office Mode pool on servers with no business link, plus 4768/4769 with RC4 (Kerberoasting) and SMB/RDP sweeps from the pool. KQL shape: SecurityEvent | where EventID in (4624,4625) and IpAddress startswith "<OfficeMode-prefix>" | summarize dcount(Computer) by Account, IpAddress
   • Ransomware precursors: Sysmon EID 1 or EDR process chains showing rclone.exe, AnyDesk, PsExec, vssadmin delete shadows or AdFind on hosts reached from the VPN segment.

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

A logic flow weakness in Remote Access and Mobile Access certificate validation in deprecated IKEv1 key exchange allows an unauthenticated remote attacker to bypass user authentication and establish a remote access VPN connection without a valid user password.

Source: pwn.watch, CISA KEV Catalog, NVD (NIST), CVE.org (MITRE), CSA/SingCERT, cvelistv5

Vendors and products

• Check Point Check Point Gaia OS
• Check Point Quantum Security Gateway

Weakness classes (CWE)

• CWE-287Improper Authentication

  Class

  When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

  Entry at MITRE CWE-287

References & sources

• support.checkpoint.comresults/sk/sk185033
• blog.checkpoint.comCheck Point Security Gateway — CVE-2026-50751Vendor advisory, pwn-watch
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2026-50751government-resource
• cert.atCERT.at: Angriffe gegen Checkpoint VPN Lösungen - Hotfix verfügbarcert-at
• pwn.watchpwn.watch: Check Point Security Gateway: Check Point Security Gateway Improper Authentication Vulnerabilitypwn-watch
• NVD (NIST)NVD: CVE-2026-50751pwn-watch
• cisa.govCISA Known Exploited Vulnerabilities Catalogpwn-watch

Changes to this CVE

Who changed this CVE and when: NVD (analysis, affected products, CVSS), the CVE publisher (CNA) and additional providers such as CISA (ADP).

1. 08.06.2026CISA KEV entry updated9119a7d8…

   4 individual changes: Date Added, Due Date, Required Action, Vulnerability Name

   Show 4 original changes

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   Date Added	added	—	2026-06-08
   Due Date	added	—	2026-06-08
   Required Action	added	—	2026-06-08
   Vulnerability Name	added	—	2026-06-08

   Source identifier: 9119a7d8-5eab-497f-8521-727c672e3725

2. 08.06.2026Record modifiedCISA ADP

   New references:

   • https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-50751
   Show the original change

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   Reference	added	—	https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-50751

   Source identifier: 134c704f-9b21-4f2e-91b3-4a467353bcc0

3. 08.06.2026Record modifiedCISA ADP

   CVSS V3.1: AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

   New references:

   • https://blog.checkpoint.com/security/check-point-releases-important-hotfix-for-vulnerabilities-in-deprecated-ikev1-vpn-protocol/
   Show 2 original changes

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   CVSS	added	—	AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
   Reference	added	—	https://blog.checkpoint.com/security/check-point-releases-important-hotfix-for-vulnerabilities-in-deprecated-ikev1-vpn-protocol/

   Source identifier: 134c704f-9b21-4f2e-91b3-4a467353bcc0

4. 08.06.2026Receivedcheckpoint.com

   Weakness type: CWE-287

   Description added or changed

   New references:

   • https://support.checkpoint.com/results/sk/sk185033
   Show 3 original changes

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   Description	added	—	A logic flow weakness in Remote Access and Mobile Access certificate validation in deprecated IKEv1 key exchange allows an unauthenticated remote attacker to bypass user authentication and establish a remote access VPN connection without a valid user password.
   Weakness type (CWE)	added	—	CWE-287
   Reference	added	—	https://support.checkpoint.com/results/sk/sk185033

   Source identifier: cve@checkpoint.com

One NVD translation into another language is hidden.