# Check Point Remote Access VPN lets attackers in without a password over IKEv1

Source: https://startwithidentity.com/cves/cve-2026-50751/
Last updated: 2026-11-05
License: content by Start with Identity. Cite the source URL.

---

## What broke

Check Point Remote Access VPN and Mobile Access gateways that still accept the deprecated IKEv1 key exchange had a logic flaw in certificate validation. Check Point's June 8, 2026 advisory says an unauthenticated attacker could use it to "establish a VPN session without possession of a valid password." The weakness is improper authentication (CWE-287), and the CVSS 3.1 score listed in NVD is 9.3. Affected releases run from R80.20.X and R80.40 through R81.10.X, R81.20, R82, R82.00.X and R82.10, plus Spark Firewall; several of those are already end of support. Check Point shipped hotfixes and documents them in sk185033.

Check Point Research began investigating on June 4 and dated the earliest exploitation to May 7, 2026. It counted "a few dozen targeted organizations globally," and in one case confirmed post-compromise activity tied to a Qilin ransomware affiliate. CISA added the CVE to KEV the same day the advisory went out and marks it as used in ransomware campaigns. The same review found a second IKEv1 certificate validation flaw, CVE-2026-50752, a site-to-site man-in-the-middle issue with no exploitation seen.

## Why it matters

The password was the check, and the protocol path skipped it. Anyone who could reach the gateway's IKEv1 listener arrived as a connected remote user, so the VPN's user directory and any MFA tied to the password step stopped meaning anything. This is the same pattern as [CVE-2026-0257](https://startwithidentity.com/cves/cve-2026-0257/) on GlobalProtect, and Check Point assesses the actor also exploits Palo Alto Networks, Fortinet and F5 VPN flaws. Our post on [remote-access appliances as credential vaults](https://startwithidentity.com/blog/remote-access-appliances-are-credential-vaults/) covers what attackers do next.

## What to do

- Install the hotfix from sk185033 on every Security Gateway and Spark Firewall with Remote Access or Mobile Access enabled.
- Move remote access clients off IKEv1. Check Point calls it deprecated, and sk185033 lists remote-access configuration settings as an alternative mitigation.
- Hunt VPN logs from May 7, 2026 onward for sessions from the IP addresses Check Point published, including the ones added June 9 to 11.

## After you patch

- Treat a session from those addresses as an intrusion: rotate the gateway's LDAP or RADIUS service credentials, reset passwords for users whose sessions you cannot explain, and look for Linux ELF downloads on internal hosts.

## Sources

- [NVD: CVE-2026-50751](https://nvd.nist.gov/vuln/detail/cve-2026-50751)
- [Check Point: Active exploitation of Check Point VPN authentication bypass (CVE-2026-50751), June 8, 2026](https://blog.checkpoint.com/security/check-point-releases-important-hotfix-for-vulnerabilities-in-deprecated-ikev1-vpn-protocol/)
- [Check Point sk185033](https://support.checkpoint.com/results/sk/sk185033)
- [CISA Known Exploited Vulnerabilities catalog, added June 8, 2026](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-50751)