CVE-2026-50751

User Authentication Bypass in VPN Remote Access and Mobile Access

Exploited in the wild. In CISA KEV since 2026‑06‑08. Fixed versions are out.

CVSS 3.19.3Critical EPSS percentile99th85% chance in 30 days CISA KEVListedsince 2026-06-08, due 2026-06-11
No public exploit known Fix5 products2 fixed builds listed below

Published 2026-06-08Updated 2026-08-04Sources: CVE.org, NVD, BDU

NVD CVE.org

What to do

Find your product and version, then upgrade to the build on the right.

checkpoint Quantum Security GatewayAffected: R82.10 with Jumbo Hotfix Take 19 or belowUpgrade to: not statedAffected: R82 with Jumbo Hotfix Take 103 or belowUpgrade to: not statedAffected: R81.20 with Jumbo Hotfix Take 141 or belowUpgrade to: not statedAffected: R81.10, R81, and R80.40Upgrade to: not statedStated by: CVE record
checkpoint Spark FirewallsAffected: R80.20.X, R81.10.X, and R82.00.XUpgrade to: not statedStated by: CVE record
Checkpoint Gaia OsAffected: ≥ r80.40, < r81.20Upgrade to: r81.20Stated by: NVD
Checkpoint Gaia EmbeddedAffected: ≥ r80.20.00, < r81.10.17Upgrade to: r81.10.17Stated by: NVD
Check Point Software Technologies Ltd. Check Point SparkAffected: R81.10Upgrade to: not statedStated by: BDU

Versions as the sources state them. 2 more products have version data. Full version matrix after sign-in

Steps

Written by AI from the record

Contact your IT/security person now and ask them to patch Check Point Remote Access and Mobile Access components for CVE-2026-50751 across checkpoint Quantum Security Gateway, checkpoint Spark Firewalls, checkpoint gaia os, and checkpoint gaia embedded.
Check whether you use IKEv1 for VPN remote/mobile connections, and if so, ask whether it can be disabled or replaced while you patch.
Review remote access VPN logs for unusual connection attempts or VPN sessions that do not match normal user/password activity, and escalate any suspicious findings.

Check it yourselfA free Nuclei and OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Discuss checks for your systems with a specialist. Scope is agreed before testing.

Coverage timeline

9 publishers

A Russian national and alleged core member of the Qilin ransomware gang was arrested in Japan and extradited to Germany for hacking a logistics company and extorting over $160,000.
as reported · Oct 7, 2026·SecurityWeek summary
Dragos reports rise in industrial ransomware incidents targeting IT systems to disrupt production via social engineering.
as reported · Aug 11, 2026·Help Net Security summary
Proof-of-concept published
as reported · Jul 2, 2026·The Hacker News summary
Added to CISA KEV catalog
Jun 8, 2026·CISA KEV

Sourced from public security reporting — each date is when it was published, not when it happened. 13 further articles named this CVE in wider roundups without reporting it as a distinct event.

What it is

From the CVE record

A logic flow weakness in Remote Access and Mobile Access certificate validation in deprecated IKEv1 key exchange allows an unauthenticated remote attacker to bypass user authentication and establish a remote access VPN connection without a valid user password.

In plain language

Written by AI from the record

CVE-2026-50751 is a VPN login-bypass flaw in certain Check Point products that lets attackers get into your VPN without a password—if you use Check Point Quantum Security Gateway, Spark Firewalls, or their Gaia systems for remote/mobile access, treat this as urgent and patch right away.

What is it

This bug breaks a security check that should verify a user really has permission to connect to your VPN. With the problem, an attacker can set up a remote connection without needing a valid user password. Think of it like a door that’s supposed to require a key, but a mistake in the ID-check lets someone walk in by exploiting how certificates are validated during a specific VPN handshake.

Who is affected

This matters to you if you run or administer Check Point VPN remote access and mobile access using these products: checkpoint Quantum Security Gateway, checkpoint Spark Firewalls, checkpoint gaia os, and checkpoint gaia embedded. Your risk is higher if you have remote/mobile workers connecting over VPN or if these gateways are exposed to the internet, because attackers can attempt to connect directly. The issue is tied to Remote Access and Mobile Access and specifically the deprecated IKEv1 key exchange flow.

How urgent is it

This is RED because it is being exploited in the wild and is tied to ransomware activity, meaning real attackers are actively looking for vulnerable systems. The probability of exploitation in the near term is estimated to be high, and public patch guidance is likely to be the main path to safety. You should act immediately rather than waiting for normal maintenance.

What to do — in detail

Confirm exposure

Verify which systems in your environment use Check Point Remote Access and Mobile Access: checkpoint Quantum Security Gateway, checkpoint Spark Firewalls, checkpoint gaia os, and checkpoint gaia embedded.
Determine whether VPN connections are using the deprecated IKEv1 key exchange path (since the described logic flaw is in certificate validation for that flow).

Patch and upgrade

Obtain and apply the official Check Point fixes for CVE-2026-50751 for every affected component you run (including the relevant Gaia versions).
Ensure the update is actually installed on each gateway/firewall and that services are restarted/validated according to Check Point’s procedures.

Apply mitigations if immediate patching isn’t finished

If your configuration allows it, disable or stop using the deprecated IKEv1 key exchange for remote/mobile VPN connections, and switch to the supported key exchange method(s) your environment uses.
Reduce the VPN surface area where possible (for example, restrict who can reach the VPN endpoints), but do not rely on restrictions alone if you’re still exposed to the vulnerable handshake path.

Validate and monitor

After changes, test a normal VPN login flow using legitimate users and confirm authentication behaves as expected.
Monitor logs for indicators of abuse during the timeframe before and after remediation, such as remote access sessions created without corresponding valid user password activity, anomalous certificate/handshake patterns, or repeated connection attempts.
If your logs show suspicious sessions, treat the event as potentially compromised and follow your incident response process.

Ongoing response

Because this is listed as known exploited and linked to ransomware activity, keep a heightened watch for related follow-on behavior (for example, persistence attempts, lateral movement, or unusual internal access) and ensure other perimeter and account controls are also up to date.

Technical context

CVE-2026-50751 describes a logic flow weakness in Remote Access and Mobile Access certificate validation during the deprecated IKEv1 key exchange. The impact is an authentication bypass: an unauthenticated attacker can establish a remote access VPN connection without a valid user password.

Known exploitation: marked as exploited in the wild (itw), and listed in CISA KEV as used in ransomware. A public exploit is not known to be available (as provided), and there is no Nuclei detection template currently (as provided), which can make automated detection harder.

Attack vector: remote attacker reaching the VPN remote/mobile access endpoint and triggering the vulnerable certificate validation/authentication bypass path tied to IKEv1. Weakness type: authentication bypass due to incorrect logic/validation in the handshake flow.

About EPSS/KEV (in plain terms): EPSS is an estimate of how likely attackers are to try exploiting this in the near future; KEV (CISA Known Exploited Vulnerabilities) indicates it’s already seen being actively exploited, which is why the urgency is high for real-world systems.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS99th

CISA KEV

Listed as exploited in the wild since 2026-06-08.

US federal agencies must remediate by 2026-06-11.

Known use in ransomware campaigns.

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

85% chance of exploitation activity in the next 30 days, which ranks it in the 99th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

28 events over 125 days, from the signal feeds we watch.

2026-10-11EPSS band changelow → highepss band change
2026-10-05EPSS band changehigh → low
2026-10-04EPSS band changehigh → low
2026-09-30EPSS band changehigh → low
2026-09-24EPSS band changehigh → lowepss band change
2026-08-04Patch availableworkaround available, record updated

Affected products

checkpointcommercial · ILaka check point firewall-1, checkpoint firewall
Check Point Software Technologies Ltd.commercial · USaka checkpoint

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

Scored 9.3 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope ChangedThe exploit can affect other components (e.g. sandbox escape, host compromise from VM)

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity LowData modification is possible but limited in scope or consequence
Availability NoneNo availability impact