CVE-2026-50751: Check Point Security Gateway IKEv1 authentication bypass

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityCritical CVSS 9.3 authentication bypass in a VPN gateway, listed in CISA KEV with known ransomware use and very high EPSS.

What it is

A logic flaw in certificate validation for Remote Access and Mobile Access in the deprecated IKEv1 key exchange lets an unauthenticated remote attacker bypass user authentication. Because the flaw sits in the VPN authentication path, it can allow a remote access VPN session to be established without a valid user password.

Impact

An attacker gains remote access VPN connectivity without valid user credentials, effectively obtaining the access level of an authenticated remote user. The scope change and high confidentiality impact indicate exposure of protected internal resources.

Attack surface

Reachable over the network via the IKEv1 remote access VPN service; no authentication or user interaction is required per the CVSS vector (AV:N/AC:L/PR:N/UI:N). Only deployments still exposing the deprecated IKEv1 key exchange are in scope.

Exploitation

Listed in CISA KEV with a due date of 2026-06-11 and flagged for known ransomware campaign use, and EPSS is 0.83771 (99.674th percentile), indicating active exploitation is expected or observed.

What to do

• Apply the vendor hotfix and mitigation steps in Check Point advisory sk185033 immediately.
• Disable or stop exposing the deprecated IKEv1 key exchange for Remote Access and Mobile Access where operationally possible.
• Restrict VPN gateway reachability to trusted sources and monitor for unexpected remote access connections.
• Follow CISA KEV required actions, including BOD 22-01 guidance for cloud services, or discontinue use if mitigations are unavailable.

Detection

• Review VPN authentication logs for successful remote access sessions that lack a valid user password or certificate validation event.
• Alert on IKEv1 remote access connections from new or unusual source IPs, especially outside normal geography or hours.
• Hunt for post-connection lateral movement or internal reconnaissance originating from VPN-assigned addresses.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.