{"id":"CVE-2026-50751","kind":"vulnerability","aliases":["CVE-2026-50751"],"related":[],"title":"A logic flow weakness in Remote Access and Mobile Access certificate validation in deprecated IKEv1 key exchange…","description":"Check Point Security Gateway contains an improper authentication vulnerability in IKEv1 key exchange that could allow an unauthenticated remote attacker to bypass user authentication and establish a remote access VPN connection without a valid user password.\n\nCISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","summary":"Check Point Security Gateway has an improper authentication flaw in its IKEv1 key exchange that lets an unauthenticated remote attacker skip user authentication. The attacker can establish a remote access VPN connection without a valid user password.","severity":"critical","cvss":9.3,"epss":null,"exploited":true,"exploited_at":"2026-06-08T00:00:00+00:00","products":[{"name":"Check Point Security Gateway","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"checkpoint gaia os","fixed":["r81.20"],"affected":">= r80.40, < r81.20","ecosystem":"vendor"},{"name":"checkpoint gaia os","fixed":[],"affected":"= r81.20","ecosystem":"vendor"},{"name":"checkpoint gaia os","fixed":[],"affected":"= r82","ecosystem":"vendor"},{"name":"checkpoint gaia os","fixed":[],"affected":"= r82.10","ecosystem":"vendor"},{"name":"checkpoint gaia embedded","fixed":["r81.10.17"],"affected":">= r80.20.00, < r81.10.17","ecosystem":"vendor"},{"name":"checkpoint gaia embedded","fixed":[],"affected":"= r81.10.17","ecosystem":"vendor"},{"name":"checkpoint gaia embedded","fixed":["r82.00.10"],"affected":">= r80.20.00, < r82.00.10","ecosystem":"vendor"},{"name":"checkpoint gaia embedded","fixed":[],"affected":"= r82.00.10","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["check-point","exploited","ikev1","infrastructure","ransomware","remote-access-vpn","vpn-gateway"],"not_affected_if":["no-ikev1-remote-access-vpn"],"how_to_check":null,"fix":"Apply the mitigations in Check Point's vendor advisory, as CISA requires; the sources do not name a fixed version. If no mitigation is available, discontinue use of the product per CISA guidance.","status":"open","published_at":"2026-06-08T00:00:00+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:33:57+00:00","updated_at":"2026-10-23T23:44:51+00:00","category":"infrastructure","confidence":0.75,"triage":{"at":"2026-10-23T20:33:57Z","model":"claude-haiku-5-5","output":{"fix":"Apply the mitigations in Check Point's vendor advisory, as CISA requires; the sources do not name a fixed version. If no mitigation is available, discontinue use of the product per CISA guidance.","summary":"Check Point Security Gateway has an improper authentication flaw in its IKEv1 key exchange that lets an unauthenticated remote attacker skip user authentication. The attacker can establish a remote access VPN connection without a valid user password.","category":"infrastructure","who_cares":["check-point","vpn-gateway","remote-access-vpn","ikev1"],"confidence":0.75,"analyst_note":"Exploited in the wild and tagged ransomware per CISA KEV; find the Check Point advisory for affected versions, fixed builds, and how to check whether IKEv1 remote access is enabled (see the KEV search URL in sources).","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-ikev1-remote-access-vpn"],"severity_if_unknown":"critical"},"cost_usd":0.000387,"input_tokens":2096,"output_tokens":354,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-01':151C '-2026':19A,22A '-50751':20A,23A '22':150C 'access':7A,10A,61B,95B,131C 'action':141C 'allow':118C 'appli':142C 'applic':148C 'attack':85B,90B,122C 'authent':73B,88B,110C,126C 'bod':149C 'bypass':124C 'certif':11A 'check':24A,53B,66B,103C 'check-point':52B 'checkpoint':28A,31A,34A,37A,40A,43A,46A,49A 'cisa':139C 'cloud':154C 'connect':97B,133C 'contain':107C 'could':117C 'cve':18A,21A 'deprec':14A 'discontinu':157C 'embedded':42A,45A,48A,51A 'establish':92B,128C 'exchang':17A,79B,115C 'exploit':55B 'flaw':74B 'flow':3A 'follow':147C 'gaia':29A,32A,35A,38A,41A,44A,47A,50A 'gateway':27A,65B,69B,106C 'guidanc':152C 'ikev1':15A,56B,77B,113C 'improp':72B,109C 'infrastructur':57B 'instruct':146C 'key':16A,78B,114C 'let':81B 'logic':2A 'mitig':143C,163C 'mobil':9A 'os':30A,33A,36A,39A 'password':102B,138C 'per':144C 'point':25A,54B,67B,104C 'product':161C 'ransomwar':58B 'remot':6A,60B,84B,94B,121C,130C 'remote-access-vpn':59B 'requir':140C 'secur':68B,105C 'security':26A 'servic':155C 'skip':86B 'unauthent':83B,120C 'unavail':165C 'use':158C 'user':87B,101B,125C,137C 'valid':12A,100B,136C 'vendor':145C 'vpn':62B,64B,96B,132C 'vpn-gateway':63B 'vulner':111C 'weak':4A 'without':98B,134C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-06-08T00:00:00+00:00","kev":{"dateAdded":"2026-06-08","dueDate":"2026-06-11","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2026-50751","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-50751","severity":null,"published_at":"2026-06-08T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T10:39:04+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-50751","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50751","severity":null,"published_at":"2026-06-08T12:16:32+00:00","modified_at":"2026-08-04T05:16:39+00:00","first_seen_at":"2026-10-23T23:44:51+00:00","fetched_at":"2026-10-23T23:44:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}