Check Point VPN: the IKEv1 flaw that lets attackers log in with no password (CVE-2026-50751)

A Check Point VPN gateway is supposed to be the one box on your network that only lets the right people in. CVE-2026-50751 turns it into the box that lets anyone in: a logic flaw in the deprecated IKEv1 key exchange lets an unauthenticated attacker complete a Remote Access or Mobile Access login without a valid password, private key, or trusted certificate. It has been exploited as a zero-day since early May 2026, it is on CISA's KEV list with a three-day patch deadline, and Check Point ties it -- with medium confidence -- to a Qilin ransomware affiliate.

The client marks its own homework

On the wire, the attack is almost insulting in its simplicity. During IKEv1 Phase-1, the gateway reads a client-supplied VPNExtFeatures Vendor ID payload -- 16 magic bytes followed by a four-byte capability field -- and writes those four bytes straight into an internal authentication-flags word. Two of those bits decide whether the gateway bothers to verify the client's signature and certificate proof. Because the client supplies the bytes, the attacker simply clears the bits and tells the gateway not to check its work. watchTowr, who reverse-engineered the IKE daemon, put it best: the client sends a little bitmask that says here is how thoroughly you should check me, and the server replies agreed.

With validation switched off, the gateway accepts a self-signed certificate carrying a random blob where a real signature should be, reads the username out of the certificate, matches it against the provisioned Remote Access users, and hands over a VPN session. No credential is ever stolen or cracked -- the check is just skipped. This only works because IKEv1 is still enabled: the equivalent client-controlled toggle does not exist in IKEv2, which is why deprecated is the operative word. And it is reachable both over UDP/500 and UDP/4500 and over TCP/443 via Check Point's Visitor Mode, so blocking UDP alone does not save you (watchTowr, Check Point).

Am I affected?

A gateway is only exploitable when all four of these are true: Remote Access or Mobile Access is enabled; deprecated IKEv1 is permitted (the gateway is not IKEv2-only); machine-certificate authentication is optional or disabled; and the IKE/VPN ports are reachable from untrusted networks. Require machine certificates or move to IKEv2-only and the attack surface disappears -- even before you patch. Products in scope are Check Point Quantum Security Gateway, Spark firewalls, and the Remote Access / Mobile Access blades.

Spark firewalls are affected across R80.20.X, R81.10.X and R82.00.X and follow the same fix. The take numbers come from Check Point's advisory sk185033 as reported by press -- the support page is login-gated, so confirm the exact take on your own box before change control (The Hacker News, Check Point sk185033). Disclosed alongside it was a lower-severity sibling, CVE-2026-50752 (CVSS 7.4), a related site-to-site IKEv1 flaw that has not been seen exploited.

How this unfolded

Who is exploiting it

Check Point observed exploitation limited to a few dozen organizations and assesses -- at medium confidence -- that the operator is financially motivated and deploys Qilin ransomware, tying at least one post-compromise incident to a Qilin affiliate through binary analysis. Rapid7 independently attributed two cases to the flaw with high confidence, and reporting describes Rclone for exfiltration and the Tox protocol for command-and-control (Rapid7, BleepingComputer). Keep the attribution in proportion: this is credible vendor incident-response analysis, not a confirmed single-actor campaign, and as of late July there is no public evidence of forum or access-broker sale listings for the bug, nor of indiscriminate internet-wide scanning -- the activity has been targeted, not opportunistic.

Detection: hunt before you trust the patch

The bypass leaves a distinctive tell: an IKEv1 remote-access session that completes with no matching authentication event. On the gateway's VPN logs, look for a peer that is not recognised as a Check Point client yet is honoured -- a not a Check Point peer line immediately followed by a successful Phase-1 SA -- or a User CN=... saved event with no preceding RADIUS/LDAP/OTP success. On a patched gateway the same attempt instead logs verifyMessagePhase1: Authentication failure with hybrid, which is a handy confirmation string.

# Confirm the installed Jumbo take and compare to the fixed thresholdsinstalled_jumbo_takecpinfo -y all | grep -i jumbo# Hunt the bypass signature in VPN/IKE logs (unpatched)grep -E 'not a Check Point peer' $FWDIR/log/ikev1.elg*grep -E 'IkeSAFromState: User CN=' $FWDIR/log/vpnd.elg*  # correlate: any without a matching auth success?

alert udp any any -> $CP_GATEWAY 500 (msg:"AUTHORED: Check Point IKEv1 VPNExtFeatures capability-flag (CVE-2026-50751 attempt)"; content:"|3c f1 87 b2 47 40 29 ea 46 ac 7f d0 ea f2 89 f5|"; content:"|00 00 00 04|"; distance:0; within:8; sid:1000751; rev:1;)

title: Possible CVE-2026-50751 IKEv1 Auth Bypass
logsource:
  product: checkpoint
  service: vpn
detection:
  bypass_marker:
    Message|contains: 'not a Check Point peer'
  sa_established:
    Message|contains: 'IkeSAFromState: User CN='
  auth_success:
    Message|contains:
      - 'RADIUS'
      - 'authenticated'
  condition: (bypass_marker and sa_established) or (sa_established and not auth_success)
level: high

Because this began as a zero-day, patching is necessary but not sufficient: hunt your logs back to 7 May 2026 for sessions that predate your fix. Arctic Wolf has published a list of attacker IP addresses to block and search for (Arctic Wolf).

Fix it -- and hunt, don't just patch

1. Reduce exposure now: if you cannot patch this hour, enforce IKEv2-only VPN encryption or make machine-certificate authentication mandatory -- either removes the vulnerable path immediately.
2. Patch to the fixed Jumbo Hotfix take per sk185033 (R81.20 Take 142+, R82 Take 104+, R82.10 Take 20+); migrate Spark and End-of-Support trains off unsupported versions.
3. Restrict which source networks can reach UDP/500, UDP/4500 and TCP/443 on the gateway, and block the published attacker IPs as a compensating control.
4. Hunt backwards to 7 May 2026 for IKEv1 sessions with no matching authentication -- a clean patch does not evict an intruder who got in beforehand.
5. Verify: re-check installed_jumbo_take on every gateway and confirm remote access no longer negotiates IKEv1.

Scores and details as of 24 July 2026

Sources

• Check Point -- Important hotfix for deprecated IKEv1 VPN vulnerabilities -- https://blog.checkpoint.com/security/check-point-releases-important-hotfix-for-vulnerabilities-in-deprecated-ikev1-vpn-protocol/
• Check Point advisory sk185033 -- https://support.checkpoint.com/results/sk/sk185033
• watchTowr Labs -- Marking Your Own Homework: Check Point IKEv1 auth bypass -- https://labs.watchtowr.com/marking-your-own-homework-check-point-remote-access-vpn-ikev1-authentication-bypass-CVE-2026-50751/
• watchTowr PoC repository -- https://github.com/watchtowrlabs/watchTowr-vs-Check-Point-CVE-2026-50751
• Rapid7 -- Critical Check Point VPN zero-day exploited in the wild -- https://www.rapid7.com/blog/post/etr-critical-check-point-vpn-zero-day-exploited-in-the-wild-CVE-2026-50751/
• The Hacker News -- Critical Check Point VPN flaw exploited (version matrix) -- https://thehackernews.com/2026/06/critical-check-point-vpn-flaw-exploited.html
• The Hacker News -- ChocoPoC RAT in fake exploit repos -- https://thehackernews.com/2026/07/new-chocopoc-rat-targets-vulnerability.html
• BleepingComputer -- CISA orders feds to patch Check Point flaw -- https://www.bleepingcomputer.com/news/security/cisa-orders-feds-to-patch-check-point-flaw-exploited-by-ransomware-gangs/
• BleepingComputer -- Check Point links zero-day to Qilin ransomware -- https://www.bleepingcomputer.com/news/security/check-point-links-vpn-zero-day-attacks-to-qilin-ransomware-gang/
• Help Net Security -- PoC exploit released -- https://www.helpnetsecurity.com/2026/06/12/CVE-2026-50751-poc-exploit/
• Tenable -- CVE-2026-50751 -- https://www.tenable.com/cve/CVE-2026-50751
• Arctic Wolf -- CVE-2026-50751 IoCs -- https://arcticwolf.com/resources/blog/CVE-2026-50751/
• ProjectDiscovery -- Nuclei template CVE-2026-50751 -- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-50751.yaml