CVE-2026-50751Check Point Remote Access VPN lets attackers in without a password over IKEv1
What broke
Check Point Remote Access VPN and Mobile Access gateways that still accept the deprecated IKEv1 key exchange had a logic flaw in certificate validation. Check Point's June 8, 2026 advisory says an unauthenticated attacker could use it to "establish a VPN session without possession of a valid password." The weakness is improper authentication (CWE-287), and the CVSS 3.1 score listed in NVD is 9.3. Affected releases run from R80.20.X and R80.40 through R81.10.X, R81.20, R82, R82.00.X and R82.10, plus Spark Firewall; several of those are already end of support. Check Point shipped hotfixes and documents them in sk185033.
Check Point Research began investigating on June 4 and dated the earliest exploitation to May 7, 2026. It counted "a few dozen targeted organizations globally," and in one case confirmed post-compromise activity tied to a Qilin ransomware affiliate. CISA added the CVE to KEV the same day the advisory went out and marks it as used in ransomware campaigns. The same review found a second IKEv1 certificate validation flaw, CVE-2026-50752, a site-to-site man-in-the-middle issue with no exploitation seen.
Why it matters
The password was the check, and the protocol path skipped it. Anyone who could reach the gateway's IKEv1 listener arrived as a connected remote user, so the VPN's user directory and any MFA tied to the password step stopped meaning anything. This is the same pattern as CVE-2026-0257 on GlobalProtect, and Check Point assesses the actor also exploits Palo Alto Networks, Fortinet and F5 VPN flaws. Our post on remote-access appliances as credential vaults covers what attackers do next.
What to do
- Install the hotfix from sk185033 on every Security Gateway and Spark Firewall with Remote Access or Mobile Access enabled.
- Move remote access clients off IKEv1. Check Point calls it deprecated, and sk185033 lists remote-access configuration settings as an alternative mitigation.
- Hunt VPN logs from May 7, 2026 onward for sessions from the IP addresses Check Point published, including the ones added June 9 to 11.
After you patch
- Treat a session from those addresses as an intrusion: rotate the gateway's LDAP or RADIUS service credentials, reset passwords for users whose sessions you cannot explain, and look for Linux ELF downloads on internal hosts.
Sources
Related identity CVEs
- CVE-2026-85102Check Point VPN certificate validation flaw, from one-day to pre-auth RCE on the gateway
- CVE-2026-16232Check Point SmartConsole login hands an unauthenticated attacker an admin token
- CVE-2026-0257PAN-OS GlobalProtect accepts forged authentication override cookies
- CVE-2024-24919Check Point Security Gateway information disclosure of password hashes
Related on Start with Identity
- CVECheck Point VPN certificate validation flaw, from one-day to pre-auth RCE on the gateway
Check Point Security Gateway and Spark firewalls mishandled certificate data during VPN negotiation, giving unauthenticated code execution. Patched September 9,
- CVECheck Point SmartConsole login hands an unauthenticated attacker an admin token
A flaw in the Check Point SmartConsole login process let an unauthenticated attacker obtain an application login token and sign in to the Management Server as a
- CVECheck Point Security Gateway information disclosure of password hashes
An unauthenticated read on Check Point Security Gateways leaked password hashes, including those used for VPN and local admin. CISA KEV. May 2024. Hash disclosu
- BlogPEERSTITCH implant tags FortiOS VPN sessions to skip security checks
Unit 42 found an in-memory FortiOS implant that patches the IKE daemon so tagged VPN sessions bypass default security validations. Attackers reached root with C
- BlogCISA adds the last two Ivanti Connect Secure chain flaws to KEV after Ivanti's October 29 patch
CISA added Ivanti Connect Secure CVE-2026-111357 and CVE-2026-118527 to its exploited list on October 30, a day after Ivanti patched the root escalation UTA0576
- BlogIvanti Connect Secure auth bypass exploited; CISA gave agencies three days
CVE-2026-104935 lets an unauthenticated attacker bypass Ivanti Connect Secure's login with a crafted header and run commands. Exploited since early October by a