Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.
CVE-2026-50751 Details
Description
A logic flow weakness in Remote Access and Mobile Access certificate validation in deprecated IKEv1 key exchange allows an unauthenticated remote attacker to bypass user authentication and establish a remote access VPN connection without a valid user password.
A logic flow vulnerability has been identified in Check Point's Remote Access and Mobile Access VPN services, specifically within the deprecated IKEv1 key exchange protocol. This vulnerability allows an unauthenticated remote attacker to bypass user authentication and establish a VPN connection without a valid password. The issue arises from improper certificate validation, creating a loophole that can be exploited to gain unauthorized access.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 8, 2026Exploitation: ActiveAutomatable: YesTechnical Impact: Total
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://blog.checkpoint.com/security/check-point-releases-important-hotfix-for-vulnerabilities-in-deprecated-ikev1-vpn-protocol/ | CISA-ADP | Vendor Advisory |
| https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-50751 | CISA-ADP | US Government Resource |
| https://support.checkpoint.com/results/sk/sk185033 | [email protected] | MitigationPatchVendor Advisory |
This CVE is in CISA's Known Exploited Vulnerabilities Catalog
Reference CISA's BOD 22-01 and Known Exploited Vulnerabilities Catalog for further guidance and requirements.
| Vulnerability Name | Date Added | Due Date | Required Action |
|---|---|---|---|
| Check Point Security Gateway Improper Authentication Vulnerability | Jun 8, 2026 | Jun 11, 2026 | Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-287 | Improper Authentication | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| checkpoint gaia os | >= r80.40, < r81.20 r81.20 - r81.20 take_10 r81.20 take_101 r81.20 take_103 r81.20 take_105 r81.20 take_111 r81.20 take_113 r81.20 take_115 r81.20 take_118 r81.20 take_119 r81.20 take_120 r81.20 take_122 r81.20 take_126 r81.20 take_127 r81.20 take_14 r81.20 take_141 r81.20 take_24 r81.20 take_26 r81.20 take_38 r81.20 take_41 r81.20 take_43 r81.20 take_45 r81.20 take_53 r81.20 take_54 r81.20 take_65 r81.20 take_70 r81.20 take_76 r81.20 take_79 r81.20 take_8 r81.20 take_84 r81.20 take_89 r81.20 take_90 r81.20 take_92 r81.20 take_96 r81.20 take_98 r81.20 take_99 r82 - r82 take_10 r82 take_103 r82 take_12 r82 take_14 r82 take_18 r82 take_19 r82 take_25 r82 take_33 r82 take_34 r82 take_36 r82 take_39 r82 take_41 r82 take_43 r82 take_44 r82 take_60 r82 take_73 r82 take_91 r82.10 - r82.10 take_19 r82.10 take_6 |
CPE
Remediation
| |
| checkpoint gaia embedded | >= r80.20.00, < r81.10.17 r81.10.17 - r81.10.17 build_996004508 r81.10.17 build_996004620 r81.10.17 build_996004653 r81.10.17 build_996004721 r81.10.17 build_996004892 >= r80.20.00, < r82.00.10 r82.00.10 - r82.00.10 build_998001559 r82.00.10 build_998001562 r82.00.10 build_998002110 r82.00.10 build_998002112 r82.00.10 build_998002133 r82.00.10 build_998002203 |
CPE
Remediation
| |
| checkpoint quantum spark 1530 | All versions |
CPE
Remediation
| |
| checkpoint quantum spark 1550 | All versions |
CPE
Remediation
| |
| checkpoint quantum spark 1570 | All versions |
CPE
Remediation
| |
| checkpoint quantum spark 1570r | All versions |
CPE
Remediation
| |
| checkpoint quantum spark 1590 | All versions |
CPE
Remediation
| |
| checkpoint quantum spark 1595r | All versions |
CPE
Remediation
| |
| checkpoint quantum spark 1600 | All versions |
CPE
Remediation
| |
| checkpoint quantum spark 1800 | All versions |
CPE
Remediation
| |
| checkpoint quantum spark 1900 | All versions |
CPE
Remediation
| |
| checkpoint quantum spark 2000 | All versions |
CPE
Remediation
| |
| checkpoint quantum spark 1535 | All versions |
CPE
Remediation
| |
| checkpoint quantum spark 1555 | All versions |
CPE
Remediation
| |
| checkpoint quantum spark 1575 | All versions |
CPE
Remediation
| |
| checkpoint quantum spark 1575r | All versions |
CPE
Remediation
| |
| checkpoint quantum spark 2530 | All versions |
CPE
Remediation
| |
| checkpoint quantum spark 2550 | All versions |
CPE
Remediation
| |
| checkpoint quantum spark 2560 | All versions |
CPE
Remediation
| |
| checkpoint quantum spark 2570 | All versions |
CPE
Remediation
| |
| checkpoint quantum spark 2580 | All versions |
CPE
Remediation
| |
| checkpoint quantum spark 2590 | All versions |
CPE
Remediation
| |
Change History
9 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 4, 2026 | CVE Modified | CISA-ADP |
| Jul 23, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 9, 2026 | Initial Analysis | [email protected] |
| Jun 8, 2026 | CVE CISA KEV Update | Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government |
| Jun 8, 2026 | CVE Modified | CISA-ADP |
| Jun 8, 2026 | CVE Modified | CISA-ADP |
| Jun 8, 2026 | New CVE Received | [email protected] |