ACTION REQUIRED – Active Exploitation of Check Point VPN Authentication Bypass (CVE-2026-50751)

[_Val_]

Check Point Research has identified active exploitation of CVE-2026-50751, a critical authentication bypass vulnerability affecting Check Point Remote Access VPN and Mobile Access deployments configured to use the deprecated IKEv1 key exchange protocol.

By exploiting a logic flaw in certificate validation, an attacker can establish a VPN session without possession of a valid password, effectively bypassing authentication requirements.

Additional post-authentication activity is required to access internal resources or escalate privileges.

To date, the observed exploitation has been limited to a few dozen targeted organizations globally. One case involved confirmed post-compromise activity associated with Qilin ransomware affiliate.

Customers using IKEv1 key exchange protocol are strongly encouraged to apply the available security updates immediately.

 

CVE Details

CVE-2026-50751 is an authentication bypass on VPN Remote Access and Mobile Access in deprecated IKEv1 key exchange. An attacker can bypass user authentication by exploiting a logic flow weakness in the Remote Access and Mobile Access certificate validation and establish a remote access VPN connection without a valid user password. Check Point has observed active exploitation of this vulnerability in the wild.

Enhancing Security with BLAST (Check Point’s Agentic AI Code Security Platform)

As part of the CVE-2026-50751 investigation, Check Point Research conducted an extended review of the affected VPN components using BLAST, our agentic application security platform. This process identified and enabled the remediation of an additional vulnerability, CVE-2026-50752.

CVE-2026-50752 impacts certificate validation in deprecated IKEv1 key exchange and may allow man-in-the-middle interference with site-to-site VPN communications under specific conditions.

Check Point has not observed exploitation of this vulnerability in the wild; customers are advised to apply updates to mitigate potential exposure.

The identification of CVE-2026-50752 underscores the importance of combining threat intelligence, security research, and AI-assisted code analysis to proactively detect and remediate vulnerabilities before they can be weaponized.

For more details, please read the relevant blog entry.
 
Additional technical information, suspicious IPs, and indicators can also be found on the security knowledge base articles here: 

https://support.checkpoint.com/results/sk/sk185033 

https://support.checkpoint.com/results/sk/sk185035 

[StackCap43382]

Can you paste the SKs here please? The Support Portal is having issues for our team.

[Lesley]

Same, unable to open the SK pages. Blog is working, also got news letter. 

[_Val_]

Should work now for everyone

[nooni]

Did not get this newsletter, where do i sign up ?

[Alex-]

SK's are unreachable

Results 1-10 of 57 for sk1803
We couldn't find anything for sk185033

Query was automatically corrected to sk1803

[genisis__]

Hi Val,

I suspect the Checkpoint site is overwhelmed with people checking, can you confirm if Jumbo's are updated for Gaia, and if Spark Builds are also updated?

[nmelay2]

I don't think so, this is a new CVE, which requires a specific hotfix.

[freshwater84]

Guess you saw already, that bunch of SPARKs got new firmwares...

[Arne_Boettger]

Apparently CheckPoint is another victim of the good old SlashDot Effect. It would have been wise to inform the partners a bit BEFORE the customers to give us a head start. Now, we as a partner are in the blind.

[Lesley]

Customer or partner, should not matter who goes first, does not work like that.

Here we can track the status of the outage:

https://status.checkpoint.com/incidents/v1nqhm198k42

[_Val_]

Thanks for your feedback. Both customers and partners were informed about this before this post was published. 

I understand the sentiment, but those are customers who are affected, and there is sense of urgency. 

[Paul_Stephenson]

I got the email today at 13:31 after my security consultant got it yesterday @ 13:27 and forwarded it on - 24 hours later does not feel like a sense of urgency to me! The subject date changed but the content was otherwise the same.

[_Val_]

Links should work now, we experienced a brief ddos situation 

[Dan_Moesch]

These links are not working:

• https://support.checkpoint.com/results/sk/sk185033 (CVE-2026-50751)
• https://support.checkpoint.com/results/sk/sk185035 (CVE-2026-50752)

[_Val_]

These links are working:

https://support.checkpoint.com/results/sk/sk185033 

https://support.checkpoint.com/results/sk/sk185035 

Just triple-checked. Please try them.

[Dan_Moesch]

They are working now!  Thank you!   

[_Val_]

Great to hear, and sorry for the issues before.

[genisis__]

Link to the hotfix seems down still?
Also would I be correct in saying the specific Hotfix is only required on the GW appliance?

[SR141287]

Both are not working right now.

[Ruan_Kotze]

FWIW - both links still showing as under maintenance from Southern Africa.  Perhaps someone can repost the SK content here?

[Sbolton]

Links are still down it looks like. Under Maintenance.

[Alex-]

So, does clearing "Allow older clients to connect to this gateway" is sufficient to not be vulnerable, even in IKEv1?

Is the hotfix on top of this still necessary or only for those who can't apply one of the other options?

I know it's best to patch on top of mitigations, just checking if we need to start to tour the country for updates like right now.

[Steffen_Appel]

Which clients are disallowed when I deselect this option? 

[GHaider]

"Allow older clients to connect to this gateway" <- should mainly affect clients which are not from checkpoint... i have disabled this option long ago, and still have securemote clients back to version E80.90 which still work...

[Teddy_Brewski]

I have a customer still using SecureRemote E80.62 986000452. Do you think it might affect?

[GHaider]

the oldest one i have is SecureRemote E80.72, which is still working with "Allow older clients to connect to this gateway" disabled

[Kervans110480]

Seems like both links are not working .

https://support.checkpoint.com/results/sk/sk185033 

https://support.checkpoint.com/results/sk/sk185035 

[PeterH]

Maintenance Window appears, looks like overloaded.

[genisis__]

that's wha I think, so it will be just a case of waiting.