CVEvulnerability

CVE-2026-50751

9.3 CRITICAL Known exploited Published 2026-06-08 Modified 2026-08-04 Official page ↗

CISA Known Exploited Vulnerability

Check Point Security Gateway Improper Authentication Vulnerability — Check Point Security Gateway

Check Point Security Gateway contains an improper authentication vulnerability in IKEv1 key exchange that could allow an unauthenticated remote attacker to bypass user authentication and establish a remote access VPN connection without a valid user password.

Added to KEV
2026-06-08
Remediation due
2026-06-11
Ransomware use
Known
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Notes
https://blog.checkpoint.com/security/check-point-releases-important-hotfix-for-vulnerabilities-in-deprecated-ikev1-vpn-protocol/ ; https://support.checkpoint.com/results/sk/sk185033?_gl=1*1wqeqhc*_gcl_au*MTI1MzE5MjI2LjE3ODA5MzQ1NTM. ; https://nvd.nist.gov/vuln/detail/CVE-2026-50751
Status
Analyzed
Published
2026-06-08
Last modified
2026-08-04
Assigner
[email protected]
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
9.3 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
Weaknesses
CWE-287

Description

A logic flow weakness in Remote Access and Mobile Access certificate validation in deprecated IKEv1 key exchange allows an unauthenticated remote attacker to bypass user authentication and establish a remote access VPN connection without a valid user password.

Affected configurations

• checkpoint gaia os (>= r80.40 < r81.20) • checkpoint gaia os r81.20 • checkpoint gaia os r82 • checkpoint gaia os r82.10 • checkpoint gaia embedded (>= r80.20.00 < r81.10.17) • checkpoint gaia embedded r81.10.17 • checkpoint gaia embedded (>= r80.20.00 < r82.00.10) • checkpoint gaia embedded r82.00.10

Related

Weakness · CWE (1)

  • CWE-287 Improper Authentication weakness

References