Intel

CVE-2026-50751

A logic flow weakness in Remote Access and Mobile Access certificate validation in deprecated IKEv1 key exchange allows an unauthenticate… (CVE-2026-50751)

criticalRansomwareKEV: actively exploitedPoCEPSS 84%

Description

A logic flow weakness in Remote Access and Mobile Access certificate validation in deprecated IKEv1 key exchange allows an unauthenticated remote attacker to bypass user authentication and establish a remote access VPN connection without a valid user password.

Source: CVELISTV5CISA_KEVNVDCVEORG

Response & Mitigation

Why act now?

Prioritisation rationale

With a CVSS score of 9.3 (AV:N/AC:L/PR:N/UI:N/S:C) and an EPSS percentile of 99.7 %, this vulnerability represents a near-certain exploitation risk for any internet-facing Check Point Security Gateway running the affected Gaia Embedded builds. CISA has confirmed active use in ransomware campaigns, meaning threat actors are leveraging unauthenticated VPN access as an initial foothold for lateral movement and data encryption — a pattern that directly threatens NIS2-regulated operators and KRITIS organisations. The Scope:Changed vector component is particularly significant: a successful attacker gains a trusted network position inside the VPN segment, bypassing perimeter controls entirely. Organisations should treat this as an emergency patch event regardless of standard change-management cycles; until the patch is applied, disabling IKEv1 is the only effective control.

Runbook · Step 1

Immediate response (0-24 h)

  • Apply the vendor patch: Check Point Gaia Embedded R80.20.00 through R82.00.10 are confirmed affected. Retrieve the hotfix/security update from the Check Point advisory for CVE-2026-50751 (sk article) and deploy immediately. Do not guess version numbers — verify the exact build in the vendor advisory.
  • Disable IKEv1 now: On all affected Security Gateways, disable IKEv1 for Remote Access and Mobile Access immediately. In SmartConsole, navigate to VPN Community properties → Encryption → set IKE version to "IKEv2 only", then push policy.
  • Audit all VPN sessions: Review active and historical VPN sessions for the past 72 hours for unauthenticated or anomalous tunnel establishments (SmartLog / SmartEvent → filter: "VPN Authentication" + "IKEv1").
  • Rotate certificates and credentials: Revoke and reissue all certificates used in Remote Access and Mobile Access contexts. Reset local VPN user passwords, prioritising accounts without MFA.
  • Restrict IKE traffic at the perimeter: Block or whitelist-restrict inbound UDP 500 and UDP 4500 to the affected gateways at the upstream firewall until the patch is fully deployed.
  • Activate IR if exploitation is suspected: If unknown VPN peers, unexpected tunnel establishments, or lateral movement from the VPN segment are observed, isolate the affected gateways and trigger your incident response process immediately.

Runbook · Step 2

Mitigation layers

  • Network layer: Restrict UDP 500 and UDP 4500 (IKE / IPsec NAT-T) to authorised peer IP ranges at the upstream perimeter firewall. No open internet access to these ports while IKEv1 remains enabled.
  • IPS/NGFW signature: Enable the Check Point IPS Blade signature for CVE-2026-50751 (Threat Prevention Policy → IPS → search by CVE ID). Supplement with a Suricata/Snort rule targeting anomalous IKEv1 Aggressive Mode packets lacking a valid certificate chain.
  • IAM / least privilege: Migrate Remote Access accounts using certificate-only authentication to MFA (e.g. RADIUS + OTP). Disable dormant accounts immediately.
  • Configuration hardening: In the Mobile Access Blade, permit only IKEv2 with strong cipher suites (AES-256-GCM, SHA-384, DH group 20+). Explicitly block deprecated IKEv1 Aggressive Mode in community configuration.
  • SIEM alerting: Configure an alert for any VPN authentication event logged as "Success" without a corresponding credential-exchange or password-verification entry in the same session context.

Runbook · Step 3

Detection rules

  • Check Point SmartLog / Syslog: Filter for action:accept + proto:IKEv1 + auth_method:certificate with no accompanying user_password_verified log entry. Any successful IKEv1 tunnel without password validation is a direct indicator of exploitation.
  • Network telemetry (Zeek/Suricata): In Zeek isakmp.log, alert on exchange_type == 4 (Aggressive Mode) from unknown source IPs on UDP/500 or UDP/4500. Snort/Suricata rule shape: 
    alert udp any any -> $VPN_GW [500,4500] (msg:"CVE-2026-50751 IKEv1 AggrMode anomaly"; content:"|04|"; offset:4; depth:1; sid:9999001; rev:1;)
  • SIEM / KQL (Microsoft Sentinel): 
    CommonSecurityLog | where DeviceVendor == "Check Point" and Activity contains "IKE" and Message contains "IKEv1" and Message !contains "password" | summarize count() by SourceIP, bin(TimeGenerated, 5m)
  • EDR / post-exploitation on gateway OS: Monitor the Gaia OS process tree for unexpected shell processes (bash, sh) with a parent of vpnd or iked. Use auditd execve syscall records filtered by VPN daemon PIDs to catch interactive sessions spawned after tunnel establishment.
  • Authentication log anomaly: Flag VPN authentication successes from a source IP with no preceding failed attempts and no MFA event within the same session window (< 10 s). Sigma shape: EventID: VPN_AUTH_SUCCESS AND NOT MFA_event correlated within the same session context.

Metrics

Severity
critical
Priority score
231.59
KEV status
Actively exploited
Exploit maturity
actively exploited (KEV)
XIEM Effective CVSS
9.3
Source: nvd-v3
CVSS v3
9.3
CVSS v4
—
EPSS percentile
99.7 %
Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).
EPSS score
83.8 %
High — model estimates ≥ 50% chance of real-world exploitation within 30 days.
Published
2026-06-08 11:07 UTC
CWE
CWE-287

Weakness classes (CWE)

  • CWE-287Class

    Improper Authentication

    When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

    cwe.mitre.org →

Reanalysis & status changes

Chronological NVD audit events for this CVE — reanalyses, CVSS updates, CPE diffs.

  1. CVE Translated2026-07-23 07:10 UTC· nvd@nist.gov
    • Translation: Title: varios productos de Check Point, Description: Una debilidad en el flujo lógico en la validación de certificados de Acceso Remoto y Acceso Móvil en el intercambio de claves IKEv1 obsoleto permite a un atacante remoto no autenticado eludir la autenticación de usuario y establecer una conexión VPN de acceso remoto sin una contraseña de usuario válida.
  2. CVE CISA KEV Update2026-06-08 22:00 UTC· 9119a7d8-5eab-497f-8521-727c672e3725
    • Date Added: 2026-06-08
    • Due Date: 2026-06-08
    • Required Action: 2026-06-08
    • Vulnerability Name: 2026-06-08
  3. CVE Modified2026-06-08 21:16 UTC· 134c704f-9b21-4f2e-91b3-4a467353bcc0
    • Reference: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-50751
  4. CVE Modified2026-06-08 17:16 UTC· 134c704f-9b21-4f2e-91b3-4a467353bcc0
    • CVSS V3.1: AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
    • Reference: https://blog.checkpoint.com/security/check-point-releases-important-hotfix-for-vulnerabilities-in-deprecated-ikev1-vpn-protocol/
  5. New CVE Received2026-06-08 12:16 UTC· cve@checkpoint.com
    • Description: A logic flow weakness in Remote Access and Mobile Access certificate validation in deprecated IKEv1 key exchange allows an unauthenticated remote attacker to bypass user authentication and establish a remote access VPN connection without a valid user password.
    • CWE: CWE-287
    • Reference: https://support.checkpoint.com/results/sk/sk185033

Affected operating systems

  • other

    checkpoint / gaia_embeddedr81.10.17

  • other

    checkpoint / gaia_embeddedr82.00.10

  • other

    checkpoint / gaia_embedded

  • other

    checkpoint / gaia_osr81.20

  • other

    checkpoint / gaia_osr82

  • other

    checkpoint / gaia_osr82.10

  • other

    checkpoint / gaia_os

Public exploit references

Public proof-of-concepts and detection templates for this vulnerability. Maturity ranges from reported PoCs through working detection scripts up to fully weaponized exploit modules. NEOSEC mirrors the code internally for forensic analysis; externally we only link to the original sources.

References & sources

IDCVE-2026-50751