9.3

CVE-2026-50751: Check Point Security Gateway Improper Authentication Vulnerability

CVSS: 9.3v3.1CriticalKEVRansomwareAnalyzed
Published 08-06-2026Last modified 04-08-2026
Open JSON

Vulnerability summary

CVE-2026-50751 is a critical (CVSS 9.3) Improper Authentication vulnerability in Check Point Security Gateway. It is known to be exploited: CISA and CIRCL list it, first on 08-06-2026. It has been used in ransomware campaigns. EPSS estimates a 85.34% chance of exploitation in the next 30 days, higher than 99.7% of scored vulnerabilities.

Overall risk
90/100
0100
Critical · default modelHow is this calculated?
CVSS score
9.3/10
010
Critical · v3.1 (CVE.org)
EPSS score
85.34%
0%100%
Critical · +1.57 pp in 30 days
KEVListedCISA · CIRCL
RansomwareKnown useFlagged by CISA
Public exploits0No public exploits recorded

Timeline

  1. 08-06-2026
    PublishedVulnerability first disclosed.
  2. 08-06-2026
    Added to CISA KEVCheck Point Security Gateway Improper Authentication Vulnerability
  3. 08-06-2026
    Added to CIRCL KEVAdded to the CIRCL known exploited vulnerabilities catalog.
  4. 11-06-2026
    CISA remediation dueApply mitigations per vendor instructions.
  5. 04-08-2026
    Last modifiedVulnerability information updated.

Description

A logic flow weakness in Remote Access and Mobile Access certificate validation in deprecated IKEv1 key exchange allows an unauthenticated remote attacker to bypass user authentication and establish a remote access VPN connection without a valid user password.

CVSS metrics

2 scores · 2 sources · 1 version

EPSS trend

Probability

85.34%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

+1.57 pp

From 83.77% on 18-09-2026

18-09-202618-10-2026
EPSS score
85.34%

Known exploited

Compare KEV catalogs
CISA KEVListed
Added
08-06-2026
Federal due date
11-06-2026
Ransomware
CIRCLListed
Added
08-06-2026

CISA required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. blog.checkpoint.com/security/… support.checkpoint.com/results/sk/sk185033?_gl=1*1wqeqhc*_gcl_au*MTI1MzE5MjI2LjE3ODA5MzQ1NTM. nvd.nist.gov/vuln/detail/CVE-2026-50751

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Checkpoint4 products
  • gaia_embedded≥ r80.20.00, < r81.10.17 | r81.10.17 | r81.10.17:build_996004508 | r81.10.17:build_996004620 | r81.10.17:build_996004653 | r81.10.17:build_996004721 | r81.10.17:build_996004892 | ≥ r80.20.00, < r82.00.10 | r82.00.10 | r82.00.10:build_998001559 | r82.00.10:build_998001562 | r82.00.10:build_998002110 | r82.00.10:build_998002112 | r82.00.10:build_998002133 | r82.00.10:build_998002203
  • gaia_os≥ r80.40, < r81.20 | r81.20 | r81.20:take_10 | r81.20:take_101 | r81.20:take_103 | r81.20:take_105 | r81.20:take_111 | r81.20:take_113 | r81.20:take_115 | r81.20:take_118 | r81.20:take_119 | r81.20:take_120 | r81.20:take_122 | r81.20:take_126 | r81.20:take_127 | r81.20:take_14 | r81.20:take_141 | r81.20:take_24 | r81.20:take_26 | r81.20:take_38 | r81.20:take_41 | r81.20:take_43 | r81.20:take_45 | r81.20:take_53 | r81.20:take_54 | r81.20:take_65 | r81.20:take_70 | r81.20:take_76 | r81.20:take_79 | r81.20:take_8 | r81.20:take_84 | r81.20:take_89 | r81.20:take_90 | r81.20:take_92 | r81.20:take_96 | r81.20:take_98 | r81.20:take_99 | r82 | r82:take_10 | r82:take_103 | r82:take_12 | r82:take_14 | r82:take_18 | r82:take_19 | r82:take_25 | r82:take_33 | r82:take_34 | r82:take_36 | r82:take_39 | r82:take_41 | r82:take_43 | r82:take_44 | r82:take_60 | r82:take_73 | r82:take_91 | r82.10 | r82.10:take_19 | r82.10:take_6
  • quantum_security_gateway_firmwareR82.10 with Jumbo Hotfix Take 19 or below | R82 with Jumbo Hotfix Take 103 or below | R81.20 with Jumbo Hotfix Take 141 or below | R81.10, R81, and R80.40
  • spark firewallsR80.20.X, R81.10.X, and R82.00.X

1 vendor · 4 products

References

3 links