Tia N.List

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2026-50751 9.3
Check Point · Security Gateway · Added 2026-06-08
3-Day Required PoC Available KEV Automatable Active Exploitation

Details

VulnerabilityCheck Point Security Gateway Improper Authentication Vulnerability
VendorCheck Point
ProductSecurity Gateway
Date added2026-06-08
Due date2026-06-11
CISA catalogView on CISA KEV catalog
Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CWECWE-287
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
Descriptions

KEV: Check Point Security Gateway contains an improper authentication vulnerability in IKEv1 key exchange that could allow an unauthenticated remote attacker to bypass user authentication and establish a remote access VPN connection without a valid user password.

NVD: A logic flow weakness in Remote Access and Mobile Access certificate validation in deprecated IKEv1 key exchange allows an unauthenticated remote attacker to bypass user authentication and establish a remote access VPN connection without a valid user password.

Compliance SSVC + BOD 26-04

Automatableyes
Technical impacttotal
Exploitation statusactive
3-day qualifyingYes
Public timeline3 days + forensic
Non-public timeline3 days + forensic
Forensic (public)Required
Forensic (non-public)Required

Research metadata

Last researched2026-08-26 03:41 UTC
Wall time0.5s
Searches5
Component defaultunknown
Sources https://support.checkpoint.com/results/sk/sk185033
https://www.mallory.ai/vulnerabilities/CVE-2026-50751
https://advisories.checkpoint.com/defense/advisories/public/2026/cpai-2026-7109.html
https://cve.halosecurity.com/cve-advisory/cve-2026-50751-check-point-security-gateway-improper-authentication
https://blog.checkpoint.com/security/check-point-releases-important-hotfix-for-vulnerabilities-in-deprecated-ikev1-vpn-protocol/
https://advisories.checkpoint.com/defense/advisories/public/2026/cpai-2026-7105.html
https://nvd.nist.gov/vuln/detail/CVE-2026-50751
https://github.com/fevar54/CVE-2026-50751---Check-Point-IKEv1-Authentication-Bypass-Exploit

QC notes

warn component_extraction: Component 'IKEv1 key exchange certificate validation logic in Remote Access VPN and Mobile Access VPN services on Security Gateways' matches or contains product name 'Security Gateway' — no specific component identified

Hunting hypothesis agent

Hunt for IKEv1 Main Mode on UDP 500/4500 from external IPs establishing an SA without auth logs, and alert on SmartConsole Key Install from attacker IPs (45.77.149.152, 209.182.225.136) uncorrelated with legitimate VPN user logins.

Research details

ComponentIKEv1 key exchange certificate validation logic in Remote Access VPN and Mobile Access VPN services on Security Gateways
PreconditionsCheck Point Security Gateways running Gaia OS R80.20.X through R82.10 (including Spark Firewalls R80.20.X, R81.10.X, R82.00.X) with Remote Access VPN or Mobile Access enabled and the deprecated IKEv1 key exchange protocol active. The gateway must accept legacy Remote Access clients without requiring machine certificates. No user credentials or authentication are required. The attacker sends crafted IKEv1 Main Mode packets containing manipulated KE (Key Exchange) and NONCE payloads that exploit a logic flaw in the certificate validation flow, allowing the IKE SA to be established without valid authentication. After the IKE SA is established, the attacker can establish a VPN tunnel and gain network-level access to the protected network. Additional post-authentication activity is required to access specific internal resources or escalate privileges. Active exploitation since May 7, 2026; Qilin ransomware affiliate activity observed in one confirmed post-compromise case. agent
DeliveryCrafted IKEv1 Main Mode packets sent via UDP port 500 (or UDP 4500 for NAT-T) to the Security Gateway's IKE daemon. The packets contain manipulated Key Exchange (KE) and Nonce (NONCE) payloads that exploit the certificate validation logic flaw to establish an IKE Security Association without completing proper authentication. Once the IKE SA is established, the attacker negotiates IPsec Phase 2 to create a VPN tunnel providing network access to the protected environment.
Public PoCyes
PoC URLs https://github.com/fevar54/CVE-2026-50751---Check-Point-IKEv1-Authentication-Bypass-Exploit Third-party repos; verify before use.
Advisoryhttps://support.checkpoint.com/results/sk/sk185033
Exploit notesCVSS 9.3 (Critical). Public PoC available on GitHub (fevar54/CVE-2026-50751) implementing both a detection scanner and an exploitation module using Python 3.8+ with scapy and cryptography libraries. The exploit sends crafted IKEv1 Main Mode packets with manipulated KE + NONCE payloads that bypass certificate validation. The PoC demonstrates full IKE SA establishment and VPN tunnel creation without credentials, providing internal network access. Also provides a list of known attacker IPs and detection queries for SmartConsole logs. Active exploitation observed by Check Point Research since May 7, 2026, with exploitation attempts increasing in early June. Post-exploitation activity associated with Qilin ransomware affiliate in at least one case. Hotfixes available for R82.10 (Take 19), R82 (Take 103), and R81.20 (Take 141). Mitigation: disable legacy clients in SmartConsole VPN Clients settings, force IKEv2-only, or require machine certificate authentication.
SummaryCheck Point Security Gateways running Gaia OS R80.20.X through R82.10 with Remote Access VPN or Mobile Access enabled contain a critical authentication bypass vulnerability (CVSS 9.3) in the deprecated IKEv1 key exchange protocol. A logic flaw in the certificate validation flow allows an unauthenticated remote attacker to send crafted IKEv1 Main Mode packets with manipulated KE and NONCE payloads, bypassing user authentication and establishing a VPN tunnel without valid credentials. The vulnerability provides network-level access to the protected internal network. Active exploitation since May 7, 2026 was identified by Check Point Research, with exploitation attempts increasing in early June; one confirmed case involved post-compromise Qilin ransomware deployment. Check Point also discovered a related man-in-the-middle vulnerability (CVE-2026-50752) during the investigation. Hotfixes are available for all supported versions.

Tia coverage

First reported2026-06-09
First exploit report2026-06-09
Exploit report → KEV1 days after the listing

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

chocopoc-malware-targets-security-researchers-via-trojanized-poccisa-orders-feds-to-patch-check-point-vpn-zero-day-by-june-11-qicve-2026-16232-check-point-smartconsole-zero-day-actively-exploiqilin-ransomware-core-member-extradited-from-japan-to-germany

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.

Source on GitHub