{"schemaVersion":3,"id":"CVE-2026-50751","aliases":[],"status":"published","duplicateOf":null,"title":"Check Point Security Gateway Improper Authentication Vulnerability","description":"A logic flow weakness in Remote Access and Mobile Access certificate validation in deprecated IKEv1 key exchange allows an unauthenticated remote attacker to bypass user authentication and establish a remote access VPN connection without a valid user password.","dates":{"published":"2026-06-08T11:07:15.746Z","modified":"2026-08-04T03:56:11.310Z","reserved":null,"kevAdded":["2026-06-08T00:00:00.000Z","2026-06-08T00:00:00.000Z"],"kevDue":["2026-06-11T00:00:00.000Z"]},"cvss":{"headline":{"score":9.3,"severity":"critical","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":9.3,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":9.3,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.85338,"percentile":0.99717,"severity":"critical","asOf":"2026-10-18T00:00:00.000Z","change":{"pp":1.5670000000000073,"baselineDate":"2026-09-18T00:00:00.000Z","baselineScore":0.83771},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.83771,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.83771,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.83771,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.83771,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.83771,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.83771,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.83771,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.83771,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.83771,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.83771,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.06301,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.06301,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.06301,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.06301,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.06301,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.06301,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.06301,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.06301,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.06301,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.06301,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.06301,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.06416,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.06416,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.06416,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.85338,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.85338,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.85338,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.85338,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.85338,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.85338,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.85338,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.85338,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.85338,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.85338,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.85338,"percentile":0.99717}],"last30":[{"date":"2026-09-18T00:00:00.000Z","score":0.83771,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.83771,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.83771,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.83771,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.83771,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.83771,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.06301,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.06301,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.06301,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.06301,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.06301,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.06301,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.06301,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.06301,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.06301,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.06301,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.06301,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.06416,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.06416,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.06416,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.85338,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.85338,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.85338,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.85338,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.85338,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.85338,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.85338,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.85338,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.85338,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.85338,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.85338,"percentile":0.99717}]},"kev":{"state":"listed","entries":[{"source":"cisa","sourceLabel":"CISA","dateAdded":"2026-06-08T00:00:00.000Z","dueDate":"2026-06-11T00:00:00.000Z","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","name":"Check Point Security Gateway Improper Authentication Vulnerability","description":"Check Point Security Gateway contains an improper authentication vulnerability in IKEv1 key exchange that could allow an unauthenticated remote attacker to bypass user authentication and establish a remote access VPN connection without a valid user password.","notes":[{"type":"url","href":"https://blog.checkpoint.com/security/check-point-releases-important-hotfix-for-vulnerabilities-in-deprecated-ikev1-vpn-protocol/","label":"blog.checkpoint.com/security/…"},{"type":"url","href":"https://support.checkpoint.com/results/sk/sk185033?_gl=1*1wqeqhc*_gcl_au*MTI1MzE5MjI2LjE3ODA5MzQ1NTM.","label":"support.checkpoint.com/results/sk/sk185033?_gl=1*1wqeqhc*_gcl_au*MTI1MzE5MjI2LjE3ODA5MzQ1NTM."},{"type":"url","href":"https://nvd.nist.gov/vuln/detail/CVE-2026-50751","label":"nvd.nist.gov/vuln/detail/CVE-2026-50751"}],"vendor":"Check Point","product":"Security Gateway","ransomware":true,"ransomwareUse":"Known","exploitationType":null},{"source":"circl","sourceLabel":"CIRCL","dateAdded":"2026-06-08T00:00:00.000Z","dueDate":null,"requiredAction":null,"name":null,"description":null,"notes":[],"vendor":null,"product":null,"ransomware":false,"ransomwareUse":null,"exploitationType":null}],"listedCount":2,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":true,"entry":{"source":"cisa","sourceLabel":"CISA","dateAdded":"2026-06-08T00:00:00.000Z","dueDate":"2026-06-11T00:00:00.000Z","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","name":"Check Point Security Gateway Improper Authentication Vulnerability","description":"Check Point Security Gateway contains an improper authentication vulnerability in IKEv1 key exchange that could allow an unauthenticated remote attacker to bypass user authentication and establish a remote access VPN connection without a valid user password.","notes":[{"type":"url","href":"https://blog.checkpoint.com/security/check-point-releases-important-hotfix-for-vulnerabilities-in-deprecated-ikev1-vpn-protocol/","label":"blog.checkpoint.com/security/…"},{"type":"url","href":"https://support.checkpoint.com/results/sk/sk185033?_gl=1*1wqeqhc*_gcl_au*MTI1MzE5MjI2LjE3ODA5MzQ1NTM.","label":"support.checkpoint.com/results/sk/sk185033?_gl=1*1wqeqhc*_gcl_au*MTI1MzE5MjI2LjE3ODA5MzQ1NTM."},{"type":"url","href":"https://nvd.nist.gov/vuln/detail/CVE-2026-50751","label":"nvd.nist.gov/vuln/detail/CVE-2026-50751"}],"vendor":"Check Point","product":"Security Gateway","ransomware":true,"ransomwareUse":"Known","exploitationType":null}},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":true,"entry":{"source":"circl","sourceLabel":"CIRCL","dateAdded":"2026-06-08T00:00:00.000Z","dueDate":null,"requiredAction":null,"name":null,"description":null,"notes":[],"vendor":null,"product":null,"ransomware":false,"ransomwareUse":null,"exploitationType":null}}]},"ransomware":{"state":"known","sources":["cisa"]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-287","name":"Improper Authentication","description":"When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.","type":"weakness","status":"Draft","abstraction":"Class","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/287.html"}],"affected":[{"vendor":"checkpoint","product":"gaia_embedded","name":"gaia embedded","label":"gaia_embedded","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≥ r80.20.00, < r81.10.17","noFixRecorded":false,"fixedIn":null},{"text":"r81.10.17","noFixRecorded":false,"fixedIn":null},{"text":"r81.10.17:build_996004508","noFixRecorded":false,"fixedIn":null},{"text":"r81.10.17:build_996004620","noFixRecorded":false,"fixedIn":null},{"text":"r81.10.17:build_996004653","noFixRecorded":false,"fixedIn":null},{"text":"r81.10.17:build_996004721","noFixRecorded":false,"fixedIn":null},{"text":"r81.10.17:build_996004892","noFixRecorded":false,"fixedIn":null},{"text":"≥ r80.20.00, < r82.00.10","noFixRecorded":false,"fixedIn":null},{"text":"r82.00.10","noFixRecorded":false,"fixedIn":null},{"text":"r82.00.10:build_998001559","noFixRecorded":false,"fixedIn":null},{"text":"r82.00.10:build_998001562","noFixRecorded":false,"fixedIn":null},{"text":"r82.00.10:build_998002110","noFixRecorded":false,"fixedIn":null},{"text":"r82.00.10:build_998002112","noFixRecorded":false,"fixedIn":null},{"text":"r82.00.10:build_998002133","noFixRecorded":false,"fixedIn":null},{"text":"r82.00.10:build_998002203","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ r80.20.00, < r81.10.17 | r81.10.17 | r81.10.17:build_996004508 | r81.10.17:build_996004620 | r81.10.17:build_996004653 | r81.10.17:build_996004721 | r81.10.17:build_996004892 | ≥ r80.20.00, < r82.00.10 | r82.00.10 | r82.00.10:build_998001559 | r82.00.10:build_998001562 | r82.00.10:build_998002110 | r82.00.10:build_998002112 | r82.00.10:build_998002133 | r82.00.10:build_998002203","eol":null,"hubHref":"/vendor/checkpoint/gaia_embedded"},{"vendor":"checkpoint","product":"gaia_os","name":"gaia os","label":"gaia_os","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≥ r80.40, < r81.20","noFixRecorded":false,"fixedIn":null},{"text":"r81.20","noFixRecorded":false,"fixedIn":null},{"text":"r81.20:take_10","noFixRecorded":false,"fixedIn":null},{"text":"r81.20:take_101","noFixRecorded":false,"fixedIn":null},{"text":"r81.20:take_103","noFixRecorded":false,"fixedIn":null},{"text":"r81.20:take_105","noFixRecorded":false,"fixedIn":null},{"text":"r81.20:take_111","noFixRecorded":false,"fixedIn":null},{"text":"r81.20:take_113","noFixRecorded":false,"fixedIn":null},{"text":"r81.20:take_115","noFixRecorded":false,"fixedIn":null},{"text":"r81.20:take_118","noFixRecorded":false,"fixedIn":null},{"text":"r81.20:take_119","noFixRecorded":false,"fixedIn":null},{"text":"r81.20:take_120","noFixRecorded":false,"fixedIn":null},{"text":"r81.20:take_122","noFixRecorded":false,"fixedIn":null},{"text":"r81.20:take_126","noFixRecorded":false,"fixedIn":null},{"text":"r81.20:take_127","noFixRecorded":false,"fixedIn":null},{"text":"r81.20:take_14","noFixRecorded":false,"fixedIn":null},{"text":"r81.20:take_141","noFixRecorded":false,"fixedIn":null},{"text":"r81.20:take_24","noFixRecorded":false,"fixedIn":null},{"text":"r81.20:take_26","noFixRecorded":false,"fixedIn":null},{"text":"r81.20:take_38","noFixRecorded":false,"fixedIn":null},{"text":"r81.20:take_41","noFixRecorded":false,"fixedIn":null},{"text":"r81.20:take_43","noFixRecorded":false,"fixedIn":null},{"text":"r81.20:take_45","noFixRecorded":false,"fixedIn":null},{"text":"r81.20:take_53","noFixRecorded":false,"fixedIn":null},{"text":"r81.20:take_54","noFixRecorded":false,"fixedIn":null},{"text":"r81.20:take_65","noFixRecorded":false,"fixedIn":null},{"text":"r81.20:take_70","noFixRecorded":false,"fixedIn":null},{"text":"r81.20:take_76","noFixRecorded":false,"fixedIn":null},{"text":"r81.20:take_79","noFixRecorded":false,"fixedIn":null},{"text":"r81.20:take_8","noFixRecorded":false,"fixedIn":null},{"text":"r81.20:take_84","noFixRecorded":false,"fixedIn":null},{"text":"r81.20:take_89","noFixRecorded":false,"fixedIn":null},{"text":"r81.20:take_90","noFixRecorded":false,"fixedIn":null},{"text":"r81.20:take_92","noFixRecorded":false,"fixedIn":null},{"text":"r81.20:take_96","noFixRecorded":false,"fixedIn":null},{"text":"r81.20:take_98","noFixRecorded":false,"fixedIn":null},{"text":"r81.20:take_99","noFixRecorded":false,"fixedIn":null},{"text":"r82","noFixRecorded":false,"fixedIn":null},{"text":"r82:take_10","noFixRecorded":false,"fixedIn":null},{"text":"r82:take_103","noFixRecorded":false,"fixedIn":null},{"text":"r82:take_12","noFixRecorded":false,"fixedIn":null},{"text":"r82:take_14","noFixRecorded":false,"fixedIn":null},{"text":"r82:take_18","noFixRecorded":false,"fixedIn":null},{"text":"r82:take_19","noFixRecorded":false,"fixedIn":null},{"text":"r82:take_25","noFixRecorded":false,"fixedIn":null},{"text":"r82:take_33","noFixRecorded":false,"fixedIn":null},{"text":"r82:take_34","noFixRecorded":false,"fixedIn":null},{"text":"r82:take_36","noFixRecorded":false,"fixedIn":null},{"text":"r82:take_39","noFixRecorded":false,"fixedIn":null},{"text":"r82:take_41","noFixRecorded":false,"fixedIn":null},{"text":"r82:take_43","noFixRecorded":false,"fixedIn":null},{"text":"r82:take_44","noFixRecorded":false,"fixedIn":null},{"text":"r82:take_60","noFixRecorded":false,"fixedIn":null},{"text":"r82:take_73","noFixRecorded":false,"fixedIn":null},{"text":"r82:take_91","noFixRecorded":false,"fixedIn":null},{"text":"r82.10","noFixRecorded":false,"fixedIn":null},{"text":"r82.10:take_19","noFixRecorded":false,"fixedIn":null},{"text":"r82.10:take_6","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ r80.40, < r81.20 | r81.20 | r81.20:take_10 | r81.20:take_101 | r81.20:take_103 | r81.20:take_105 | r81.20:take_111 | r81.20:take_113 | r81.20:take_115 | r81.20:take_118 | r81.20:take_119 | r81.20:take_120 | r81.20:take_122 | r81.20:take_126 | r81.20:take_127 | r81.20:take_14 | r81.20:take_141 | r81.20:take_24 | r81.20:take_26 | r81.20:take_38 | r81.20:take_41 | r81.20:take_43 | r81.20:take_45 | r81.20:take_53 | r81.20:take_54 | r81.20:take_65 | r81.20:take_70 | r81.20:take_76 | r81.20:take_79 | r81.20:take_8 | r81.20:take_84 | r81.20:take_89 | r81.20:take_90 | r81.20:take_92 | r81.20:take_96 | r81.20:take_98 | r81.20:take_99 | r82 | r82:take_10 | r82:take_103 | r82:take_12 | r82:take_14 | r82:take_18 | r82:take_19 | r82:take_25 | r82:take_33 | r82:take_34 | r82:take_36 | r82:take_39 | r82:take_41 | r82:take_43 | r82:take_44 | r82:take_60 | r82:take_73 | r82:take_91 | r82.10 | r82.10:take_19 | r82.10:take_6","eol":null,"hubHref":"/vendor/checkpoint/gaia_os"},{"vendor":"checkpoint","product":"quantum_security_gateway_firmware","name":"Quantum Security Gateway","label":"quantum_security_gateway_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"R82.10 with Jumbo Hotfix Take 19 or below","noFixRecorded":false,"fixedIn":null},{"text":"R82 with Jumbo Hotfix Take 103 or below","noFixRecorded":false,"fixedIn":null},{"text":"R81.20 with Jumbo Hotfix Take 141 or below","noFixRecorded":false,"fixedIn":null},{"text":"R81.10, R81, and R80.40","noFixRecorded":false,"fixedIn":null}],"versionsText":"R82.10 with Jumbo Hotfix Take 19 or below | R82 with Jumbo Hotfix Take 103 or below | R81.20 with Jumbo Hotfix Take 141 or below | R81.10, R81, and R80.40","eol":null,"hubHref":"/vendor/checkpoint/quantum_security_gateway"},{"vendor":"checkpoint","product":"spark firewalls","name":"Spark Firewalls","label":"spark firewalls","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"R80.20.X, R81.10.X, and R82.00.X","noFixRecorded":false,"fixedIn":null}],"versionsText":"R80.20.X, R81.10.X, and R82.00.X","eol":null,"hubHref":"/vendor/checkpoint/spark_firewalls"}],"affectedCount":4,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://support.checkpoint.com/results/sk/sk185033","label":"support.checkpoint.com/results/sk/sk185033","hostname":"support.checkpoint.com","tags":["Mitigation","Patch","Vendor Advisory"]},{"url":"https://blog.checkpoint.com/security/check-point-releases-important-hotfix-for-vulnerabilities-in-deprecated-ikev1-vpn-protocol/","label":"blog.checkpoint.com/security/…","hostname":"blog.checkpoint.com","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-50751","label":"www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-50751","hostname":"www.cisa.gov","tags":["Government Resource","US Government Resource"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2026-06-08T11:07:15.746Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"kev-added","date":"2026-06-08T00:00:00.000Z","label":"Added to CISA KEV","detail":"Check Point Security Gateway Improper Authentication Vulnerability","source":"cisa"},{"kind":"kev-added","date":"2026-06-08T00:00:00.000Z","label":"Added to CIRCL KEV","detail":"Added to the CIRCL known exploited vulnerabilities catalog.","source":"circl"},{"kind":"kev-due","date":"2026-06-11T00:00:00.000Z","label":"CISA remediation due","detail":"Apply mitigations per vendor instructions.","source":"cisa"},{"kind":"modified","date":"2026-08-04T03:56:11.310Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":90,"level":"critical","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T08:35:19.746Z","stale":false,"partial":false}}