topic Re: ACTION REQUIRED – Active Exploitation of Check Point VPN Authentication Bypass (CVE-2026-50751) in General Topics

ACTION REQUIRED – Active Exploitation of Check Point VPN Authentication Bypass (CVE-2026-50751)

_Val_ — Mon, 08 Jun 2026 12:34:39 GMT

Check Point Research has identified active exploitation of CVE-2026-50751, a critical authentication bypass vulnerability affecting Check Point Remote Access VPN and Mobile Access deployments configured to use the deprecated IKEv1 key exchange protocol.

By exploiting a logic flaw in certificate validation, an attacker can establish a VPN session without possession of a valid password, effectively bypassing authentication requirements.

Additional post-authentication activity is required to access internal resources or escalate privileges.

To date, the observed exploitation has been limited to a few dozen targeted organizations globally. One case involved confirmed post-compromise activity associated with Qilin ransomware affiliate.

Customers using IKEv1 key exchange protocol are strongly encouraged to apply the available security updates immediately.

CVE Details

CVE-2026-50751 is an authentication bypass on VPN Remote Access and Mobile Access in deprecated IKEv1 key exchange. An attacker can bypass user authentication by exploiting a logic flow weakness in the Remote Access and Mobile Access certificate validation and establish a remote access VPN connection without a valid user password. Check Point has observed active exploitation of this vulnerability in the wild.

Enhancing Security with BLAST (Check Point’s Agentic AI Code Security Platform)

As part of the CVE-2026-50751 investigation, Check Point Research conducted an extended review of the affected VPN components using BLAST, our agentic application security platform. This process identified and enabled the remediation of an additional vulnerability, CVE-2026-50752.

CVE-2026-50752 impacts certificate validation in deprecated IKEv1 key exchange and may allow man-in-the-middle interference with site-to-site VPN communications under specific conditions.

Check Point has not observed exploitation of this vulnerability in the wild; customers are advised to apply updates to mitigate potential exposure.

The identification of CVE-2026-50752 underscores the importance of combining threat intelligence, security research, and AI-assisted code analysis to proactively detect and remediate vulnerabilities before they can be weaponized.

For more details, please read the relevant blog entry.

Additional technical information, suspicious IPs, and indicators can also be found on the security knowledge base articles here:

https://support.checkpoint.com/results/sk/sk185033

https://support.checkpoint.com/results/sk/sk185035

Re: ACTION REQUIRED – Active Exploitation of Check Point VPN Authentication Bypass (CVE-2026-50751)

StackCap43382 — Mon, 08 Jun 2026 11:40:12 GMT

Can you paste the SKs here please? The Support Portal is having issues for our team.

Re: ACTION REQUIRED – Active Exploitation of Check Point VPN Authentication Bypass (CVE-2026-50751)

Alex- — Mon, 08 Jun 2026 11:41:11 GMT

SK's are unreachable

Results 1-10 of 57 for sk1803 We couldn't find anything for sk185033 Query was automatically corrected to sk1803

Re: ACTION REQUIRED – Active Exploitation of Check Point VPN Authentication Bypass (CVE-2026-50751)

Lesley — Mon, 08 Jun 2026 11:41:32 GMT

Same, unable to open the SK pages. Blog is working, also got news letter.

Re: ACTION REQUIRED – Active Exploitation of Check Point VPN Authentication Bypass (CVE-2026-50751)

genisis__ — Mon, 08 Jun 2026 11:52:36 GMT

Hi Val,

I suspect the Checkpoint site is overwhelmed with people checking, can you confirm if Jumbo's are updated for Gaia, and if Spark Builds are also updated?

Re: ACTION REQUIRED – Active Exploitation of Check Point VPN Authentication Bypass (CVE-2026-50751)

nmelay2 — Mon, 08 Jun 2026 11:58:10 GMT

I don't think so, this is a new CVE, which requires a specific hotfix.

Re: ACTION REQUIRED – Active Exploitation of Check Point VPN Authentication Bypass (CVE-2026-50751)

Arne_Boettger — Mon, 08 Jun 2026 12:05:28 GMT

Apparently CheckPoint is another victim of the good old SlashDot Effect. It would have been wise to inform the partners a bit BEFORE the customers to give us a head start. Now, we as a partner are in the blind.

Re: ACTION REQUIRED – Active Exploitation of Check Point VPN Authentication Bypass (CVE-2026-50751)

Lesley — Mon, 08 Jun 2026 12:12:09 GMT

Customer or partner, should not matter who goes first, does not work like that.

Here we can track the status of the outage:

https://status.checkpoint.com/incidents/v1nqhm198k42

Re: ACTION REQUIRED – Active Exploitation of Check Point VPN Authentication Bypass (CVE-2026-50751)

_Val_ — Mon, 08 Jun 2026 12:16:36 GMT

Thanks for your feedback. Both customers and partners were informed about this before this post was published.

I understand the sentiment, but those are customers who are affected, and there is sense of urgency.

Re: ACTION REQUIRED – Active Exploitation of Check Point VPN Authentication Bypass (CVE-2026-50751)

_Val_ — Mon, 08 Jun 2026 12:17:22 GMT

Links should work now, we experienced a brief ddos situation

Re: ACTION REQUIRED – Active Exploitation of Check Point VPN Authentication Bypass (CVE-2026-50751)

Dan_Moesch — Mon, 08 Jun 2026 12:21:53 GMT

These links are not working:

https://support.checkpoint.com/results/sk/sk185033 (CVE-2026-50751)
https://support.checkpoint.com/results/sk/sk185035 (CVE-2026-50752)

Re: ACTION REQUIRED – Active Exploitation of Check Point VPN Authentication Bypass (CVE-2026-50751)

_Val_ — Mon, 08 Jun 2026 12:35:36 GMT

Should work now for everyone

Re: ACTION REQUIRED – Active Exploitation of Check Point VPN Authentication Bypass (CVE-2026-50751)

_Val_ — Mon, 08 Jun 2026 12:36:56 GMT

These links are working:

https://support.checkpoint.com/results/sk/sk185033

https://support.checkpoint.com/results/sk/sk185035

Just triple-checked. Please try them.

Re: ACTION REQUIRED – Active Exploitation of Check Point VPN Authentication Bypass (CVE-2026-50751)

Alex- — Mon, 08 Jun 2026 12:44:43 GMT

So, does clearing "Allow older clients to connect to this gateway" is sufficient to not be vulnerable, even in IKEv1?

Is the hotfix on top of this still necessary or only for those who can't apply one of the other options?

I know it's best to patch on top of mitigations, just checking if we need to start to tour the country for updates like right now.

Re: ACTION REQUIRED – Active Exploitation of Check Point VPN Authentication Bypass (CVE-2026-50751)

Dan_Moesch — Mon, 08 Jun 2026 12:50:51 GMT

They are working now! Thank you!

Re: ACTION REQUIRED – Active Exploitation of Check Point VPN Authentication Bypass (CVE-2026-50751)

Steffen_Appel — Mon, 08 Jun 2026 12:52:35 GMT

Which clients are disallowed when I deselect this option?

Re: ACTION REQUIRED – Active Exploitation of Check Point VPN Authentication Bypass (CVE-2026-50751)

GHaider — Mon, 08 Jun 2026 12:55:52 GMT

"Allow older clients to connect to this gateway" <- should mainly affect clients which are not from checkpoint... i have disabled this option long ago, and still have securemote clients back to version E80.90 which still work...

Re: ACTION REQUIRED – Active Exploitation of Check Point VPN Authentication Bypass (CVE-2026-50751)

_Val_ — Mon, 08 Jun 2026 13:07:25 GMT

Great to hear, and sorry for the issues before.

Re: ACTION REQUIRED – Active Exploitation of Check Point VPN Authentication Bypass (CVE-2026-50751)

genisis__ — Mon, 08 Jun 2026 13:18:26 GMT

Link to the hotfix seems down still?
Also would I be correct in saying the specific Hotfix is only required on the GW appliance?

Re: ACTION REQUIRED – Active Exploitation of Check Point VPN Authentication Bypass (CVE-2026-50751)

SR141287 — Mon, 08 Jun 2026 13:28:10 GMT

Both are not working right now.