CVE-2026-50751 (GCVE-0-2026-50751)
Vulnerability from cvelistv5 – Published: 2026-06-08 11:07 – Updated: 2026-08-04 03:56Title
User Authentication Bypass in VPN Remote Access and Mobile Access
Summary
A logic flow weakness in Remote Access and Mobile Access certificate validation in deprecated IKEv1 key exchange allows an unauthenticated remote attacker to bypass user authentication and establish a remote access VPN connection without a valid user password.
Severity
9.3 (Critical)
SSVC
Exploitation: active
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-08 00:00 UTC
CWE
- CWE-287 - Improper Authentication.
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://support.checkpoint.com/results/sk/sk185033 | |
| https://blog.checkpoint.com/security/check-point-… | vendor-advisory |
| https://www.cisa.gov/known-exploited-vulnerabilit… | government-resource |
Impacted products
2 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| checkpoint | Quantum Security Gateway |
Affected:
R82.10 with Jumbo Hotfix Take 19 or below
Affected: R82 with Jumbo Hotfix Take 103 or below Affected: R81.20 with Jumbo Hotfix Take 141 or below Affected: R81.10, R81, and R80.40 |
guessed | |
| checkpoint | Spark Firewalls |
Affected:
R80.20.X, R81.10.X, and R82.00.X
|
guessed |
CISA
Known Exploited Vulnerability - GCVE BCP-07 Compliant
KEV entry ID: ba636079-6682-4f8f-93e0-5668da7fd462
Exploited: Yes
Timestamps
First Seen: 2026-06-08
Asserted: 2026-06-08
Scope
Notes: KEV entry: Check Point Security Gateway Improper Authentication Vulnerability | Affected: Check Point / Security Gateway | Description: Check Point Security Gateway contains an improper authentication vulnerability in IKEv1 key exchange that could allow an unauthenticated remote attacker to bypass user authentication and establish a remote access VPN connection without a valid user password. | Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. | Due date: 2026-06-11 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://blog.checkpoint.com/security/check-point-releases-important-hotfix-for-vulnerabilities-in-deprecated-ikev1-vpn-protocol/ ; https://support.checkpoint.com/results/sk/sk185033?_gl=1*1wqeqhc*_gcl_au*MTI1MzE5MjI2LjE3ODA5MzQ1NTM. ; https://nvd.nist.gov/vuln/detail/CVE-2026-50751
Evidence
Type: Vendor Report
Signal: Successful Exploitation
Confidence: 80%
Source: cisa-kev
Details
| Cwes | CWE-287 |
|---|---|
| Feed | CISA Known Exploited Vulnerabilities Catalog |
| Product | Security Gateway |
| Due Date | 2026-06-11 |
| Date Added | 2026-06-08 |
| Vendorproject | Check Point |
| Vulnerabilityname | Check Point Security Gateway Improper Authentication Vulnerability |
| Knownransomwarecampaignuse | Unknown |
References
Created: 2026-06-08 20:00 UTC
| Updated: 2026-06-08 20:00 UTC
CIRCL
Known Exploited Vulnerability - GCVE BCP-07 Compliant
KEV entry ID: 9668c362-595a-4b6d-a788-a3429da4656b
Exploited: Yes
Characteristics
Remote Code Execution:
No
Authentication Required:
No
Local Access Required:
Remote
Timestamps
First Seen: 2026-06-08
Asserted: 2026-06-08
Last Seen: 2026-06-08
Scope
Notes: CVE-2026-50751 - Check Point has observed active exploitation of this vulnerability in the wild. Ref https://blog.checkpoint.com/security/check-point-releases-important-hotfix-for-vulnerabilities-in-deprecated-ikev1-vpn-protocol
Evidence
Type: Public Report
Signal: Successful Exploitation
Confidence: 100%
Source: Checkpoint
Details
| Note | https://blog.checkpoint.com/security/check-point-releases-important-hotfix-for-vulnerabilities-in-deprecated-ikev1-vpn-protocol |
|---|
Created: 2026-06-08 13:19 UTC
| Updated: 2026-06-08 13:19 UTC
Previdian
Known Exploited Vulnerability - GCVE BCP-07 Compliant
KEV entry ID: feccf252-10d1-4d86-bf22-c40658570cf5
Exploited: Yes
Timestamps
First Seen: 2026-06-08
Asserted: 2026-06-08
Scope
Notes: KEVIntel entry: User Authentication Bypass in VPN Remote Access and Mobile Access | Affected: checkpoint / Quantum Security Gateway, Spark Firewalls | CVSS: 9.3 (CRITICAL) | EPSS: 0.41152 | Used in malware: yes | Not yet in CISA KEV: False
Evidence
Type: Public Report
Signal: Confirmed Compromise
Confidence: 70%
Source: kevintel
Details
| Feed | KEVIntel (kevintel.com) |
|---|---|
| Title | User Authentication Bypass in VPN Remote Access and Mobile Access |
| Vendor | checkpoint |
| Product | Quantum Security Gateway, Spark Firewalls |
| Added Date | 2026-06-08T14:20:34.968Z |
| Cvss Score | 9.3 |
| Epss Score | 0.41152 |
| Cvss Severity | CRITICAL |
| Epss Percentile | 0.98485 |
| Used In Malware | yes |
| Ahead Of Cisa Kev |
|
| Not Yet In Cisa Kev | False |
References
Created: 2026-06-23 14:03 UTC
| Updated: 2026-07-10 06:14 UTC
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-50751",
"options": [
{
"Exploitation": "active"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-08T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
},
{
"other": {
"content": {
"dateAdded": "2026-06-08",
"reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-50751"
},
"type": "kev"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-04T03:56:11.310Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://blog.checkpoint.com/security/check-point-releases-important-hotfix-for-vulnerabilities-in-deprecated-ikev1-vpn-protocol/"
},
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-50751"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Quantum Security Gateway",
"vendor": "checkpoint",
"versions": [
{
"status": "affected",
"version": "R82.10 with Jumbo Hotfix Take 19 or below"
},
{
"status": "affected",
"version": "R82 with Jumbo Hotfix Take 103 or below"
},
{
"status": "affected",
"version": "R81.20 with Jumbo Hotfix Take 141 or below"
},
{
"status": "affected",
"version": "R81.10, R81, and R80.40"
}
]
},
{
"product": "Spark Firewalls",
"vendor": "checkpoint",
"versions": [
{
"status": "affected",
"version": "R80.20.X, R81.10.X, and R82.00.X"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A logic flow weakness in Remote Access and Mobile Access certificate validation in deprecated IKEv1 key exchange allows an unauthenticated remote attacker to bypass user authentication and establish a remote access VPN connection without a valid user password."
}
],
"metrics": [
{
"format": "CVSS",
"other": {
"content": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"type": "CVSSv4.0"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287: Improper Authentication.",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-08T11:07:15.746Z",
"orgId": "897c38be-0345-43cd-b6cf-fe179e0c4f45",
"shortName": "checkpoint"
},
"references": [
{
"url": "https://support.checkpoint.com/results/sk/sk185033"
}
],
"title": "User Authentication Bypass in VPN Remote Access and Mobile Access"
}
},
"cveMetadata": {
"assignerOrgId": "897c38be-0345-43cd-b6cf-fe179e0c4f45",
"assignerShortName": "checkpoint",
"cveId": "CVE-2026-50751",
"datePublished": "2026-06-08T11:07:15.746Z",
"dateReserved": "2026-06-07T09:42:08.251Z",
"dateUpdated": "2026-08-04T03:56:11.310Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"cisa_known_exploited": {
"cveID": "CVE-2026-50751",
"cwes": [
"CWE-287"
],
"dateAdded": "2026-06-08",
"dueDate": "2026-06-11",
"forensicTriage": "No",
"knownRansomwareCampaignUse": "Known",
"notes": "https://blog.checkpoint.com/security/check-point-releases-important-hotfix-for-vulnerabilities-in-deprecated-ikev1-vpn-protocol/ ; https://support.checkpoint.com/results/sk/sk185033?_gl=1*1wqeqhc*_gcl_au*MTI1MzE5MjI2LjE3ODA5MzQ1NTM. ; https://nvd.nist.gov/vuln/detail/CVE-2026-50751",
"product": "Security Gateway",
"requiredAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
"shortDescription": "Check Point Security Gateway contains an improper authentication vulnerability in IKEv1 key exchange that could allow an unauthenticated remote attacker to bypass user authentication and establish a remote access VPN connection without a valid user password.",
"vendorProject": "Check Point",
"vulnerabilityName": "Check Point Security Gateway Improper Authentication Vulnerability"
},
"epss": {
"cve": "CVE-2026-50751",
"date": "2026-09-21",
"epss": "0.83771",
"percentile": "0.99685"
},
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"product": "Quantum Security Gateway",
"vendor": "checkpoint",
"versions": [
{
"status": "affected",
"version": "R82.10 with Jumbo Hotfix Take 19 or below"
},
{
"status": "affected",
"version": "R82 with Jumbo Hotfix Take 103 or below"
},
{
"status": "affected",
"version": "R81.20 with Jumbo Hotfix Take 141 or below"
},
{
"status": "affected",
"version": "R81.10, R81, and R80.40"
}
]
},
{
"product": "Spark Firewalls",
"vendor": "checkpoint",
"versions": [
{
"status": "affected",
"version": "R80.20.X, R81.10.X, and R82.00.X"
}
]
}
],
"source": "cve@checkpoint.com"
}
],
"cisaActionDue": "2026-06-11",
"cisaExploitAdd": "2026-06-08",
"cisaRequiredAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
"cisaVulnerabilityName": "Check Point Security Gateway Improper Authentication Vulnerability",
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:checkpoint:gaia_os:*:*:*:*:*:*:*:*",
"matchCriteriaId": "8FF872BA-A562-41C5-9BEE-E23DA78F8D35",
"versionEndExcluding": "r81.20",
"versionStartIncluding": "r80.40",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:checkpoint:gaia_os:r81.20:-:*:*:*:*:*:*",
"matchCriteriaId": "C939766C-B8F9-4D87-A0C1-AF184DF24411",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:checkpoint:gaia_os:r81.20:take_10:*:*:*:*:*:*",
"matchCriteriaId": "4EC030B6-DA6D-4500-8BFB-9C5336DA5C96",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:checkpoint:gaia_os:r81.20:take_101:*:*:*:*:*:*",
"matchCriteriaId": "FB9F857E-1288-4D34-A0EF-D1CC57C3F507",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:checkpoint:gaia_os:r81.20:take_103:*:*:*:*:*:*",
"matchCriteriaId": "24672DE2-44D1-4C57-97FD-C48932C4377B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:checkpoint:gaia_os:r81.20:take_105:*:*:*:*:*:*",
"matchCriteriaId": "70E8F526-84C1-4EC9-91DE-4696068B4B04",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:checkpoint:gaia_os:r81.20:take_111:*:*:*:*:*:*",
"matchCriteriaId": "A7C872AF-30EA-42C4-B835-04D5437A9B80",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:checkpoint:gaia_os:r81.20:take_113:*:*:*:*:*:*",
"matchCriteriaId": "10254179-61C3-4041-BCD1-64DEBD14B258",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:checkpoint:gaia_os:r81.20:take_115:*:*:*:*:*:*",
"matchCriteriaId": "6DD4809C-AE8F-4DAA-A2F4-6143798BABAC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:checkpoint:gaia_os:r81.20:take_118:*:*:*:*:*:*",
"matchCriteriaId": "1B76E242-925B-49F8-83A7-622F986BA851",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:checkpoint:gaia_os:r81.20:take_119:*:*:*:*:*:*",
"matchCriteriaId": "74290166-AD26-4BAF-B592-1E72ECE8CCC4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:checkpoint:gaia_os:r81.20:take_120:*:*:*:*:*:*",
"matchCriteriaId": "325EDC5E-3FC3-4477-80A5-1A5F4943887A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:checkpoint:gaia_os:r81.20:take_122:*:*:*:*:*:*",
"matchCriteriaId": "6A2CE5CD-F8D1-4B74-93EC-7966DBD51F90",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:checkpoint:gaia_os:r81.20:take_126:*:*:*:*:*:*",
"matchCriteriaId": "875D457D-D955-4F1B-AEF6-A550AD713741",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:checkpoint:gaia_os:r81.20:take_127:*:*:*:*:*:*",
"matchCriteriaId": "2303A0C4-5561-4BE1-ABB2-F285C89CFD1A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:checkpoint:gaia_os:r81.20:take_14:*:*:*:*:*:*",
"matchCriteriaId": "20C8BF97-A587-4444-8A3E-35F35440B60C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:checkpoint:gaia_os:r81.20:take_141:*:*:*:*:*:*",
"matchCriteriaId": "8E30891A-B93F-45E9-962E-61627422F8C7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:checkpoint:gaia_os:r81.20:take_24:*:*:*:*:*:*",
"matchCriteriaId": "8D6F2456-EAB9-4EDB-859A-BCB8DEF708B5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:checkpoint:gaia_os:r81.20:take_26:*:*:*:*:*:*",
"matchCriteriaId": "0EBD5040-8386-4ECA-9F46-97FC8B698A05",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:checkpoint:gaia_os:r81.20:take_38:*:*:*:*:*:*",
"matchCriteriaId": "63F0211F-E2D2-4729-A970-590BA162C668",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:checkpoint:gaia_os:r81.20:take_41:*:*:*:*:*:*",
"matchCriteriaId": "7EEC35AD-A996-472E-809E-D403F06B69B8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:checkpoint:gaia_os:r81.20:take_43:*:*:*:*:*:*",
"matchCriteriaId": "1F3ABB69-FAD0-4030-9A30-3E29862B68A5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:checkpoint:gaia_os:r81.20:take_45:*:*:*:*:*:*",
"matchCriteriaId": "76E00B8C-A53E-44B3-999C-93F042711CD3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:checkpoint:gaia_os:r81.20:take_53:*:*:*:*:*:*",
"matchCriteriaId": "250EBCC5-4EA9-4983-B083-561BEA0F7514",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:checkpoint:gaia_os:r81.20:take_54:*:*:*:*:*:*",
"matchCriteriaId": "0BD508BE-E9C2-4FC1-A170-93C5639F8BA9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:checkpoint:gaia_os:r81.20:take_65:*:*:*:*:*:*",
"matchCriteriaId": "5B2CC1FB-445F-44D0-A881-58F85A88263C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:checkpoint:gaia_os:r81.20:take_70:*:*:*:*:*:*",
"matchCriteriaId": "FF225C3C-D9D5-4617-B3FE-9F324B7091FE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:checkpoint:gaia_os:r81.20:take_76:*:*:*:*:*:*",
"matchCriteriaId": "C6A7AEAE-3B59-4149-BC9B-E6AAF712E9D4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:checkpoint:gaia_os:r81.20:take_79:*:*:*:*:*:*",
"matchCriteriaId": "26B917DC-9D52-4A63-B1F7-1EFD84C42EEB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:checkpoint:gaia_os:r81.20:take_8:*:*:*:*:*:*",
"matchCriteriaId": "72839A3A-5111-4663-9736-AD91E04F7B0C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:checkpoint:gaia_os:r81.20:take_84:*:*:*:*:*:*",
"matchCriteriaId": "48A0A735-EB36-4BC8-87BC-2166C1853A56",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:checkpoint:gaia_os:r81.20:take_89:*:*:*:*:*:*",
"matchCriteriaId": "10739520-2269-4423-A964-807C57CDDFAE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:checkpoint:gaia_os:r81.20:take_90:*:*:*:*:*:*",
"matchCriteriaId": "FF2A6363-A3E5-4645-BE92-30B9A4491A11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:checkpoint:gaia_os:r81.20:take_92:*:*:*:*:*:*",
"matchCriteriaId": "36AAAFB6-6041-413A-A09C-6D8F8D46DD87",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:checkpoint:gaia_os:r81.20:take_96:*:*:*:*:*:*",
"matchCriteriaId": "082D680F-D722-4A3F-917E-7B5D2CF4E1B4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:checkpoint:gaia_os:r81.20:take_98:*:*:*:*:*:*",
"matchCriteriaId": "3C101923-462C-4A5D-80CC-9392150FA03E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:checkpoint:gaia_os:r81.20:take_99:*:*:*:*:*:*",
"matchCriteriaId": "A806E4EB-6441-46A6-B856-0BBC01A978A3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:checkpoint:gaia_os:r82:-:*:*:*:*:*:*",
"matchCriteriaId": "A524CEE0-F639-48AB-9A9C-EA0A37F5DE9B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:checkpoint:gaia_os:r82:take_10:*:*:*:*:*:*",
"matchCriteriaId": "90AFA6EF-8DAF-47A7-A79C-D868F06CF379",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:checkpoint:gaia_os:r82:take_103:*:*:*:*:*:*",
"matchCriteriaId": "DE702A9E-383D-420A-BB0C-DD935F0F241C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:checkpoint:gaia_os:r82:take_12:*:*:*:*:*:*",
"matchCriteriaId": "AFC6CFAD-65D6-4F73-A486-4ADF2A6AF454",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:checkpoint:gaia_os:r82:take_14:*:*:*:*:*:*",
"matchCriteriaId": "3EAC6AB8-A27D-4711-A868-028D447554D2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:checkpoint:gaia_os:r82:take_18:*:*:*:*:*:*",
"matchCriteriaId": "BDBFA62A-8FCE-48BC-ABDB-69E72ED5AB85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:checkpoint:gaia_os:r82:take_19:*:*:*:*:*:*",
"matchCriteriaId": "486AC6A9-70E5-448A-84DC-CBA79ADCD906",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:checkpoint:gaia_os:r82:take_25:*:*:*:*:*:*",
"matchCriteriaId": "26E45155-DD2A-40E3-922D-234C2AD799C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:checkpoint:gaia_os:r82:take_33:*:*:*:*:*:*",
"matchCriteriaId": "4DF60A40-0C6B-4A16-9973-36BE2AE36981",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:checkpoint:gaia_os:r82:take_34:*:*:*:*:*:*",
"matchCriteriaId": "DB912857-F1DE-4863-AA55-37545F29B379",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:checkpoint:gaia_os:r82:take_36:*:*:*:*:*:*",
"matchCriteriaId": "9D540144-E641-4BF6-8E24-2258093CAEFC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:checkpoint:gaia_os:r82:take_39:*:*:*:*:*:*",
"matchCriteriaId": "73B84EDC-67DA-4511-A74B-09312689E51D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:checkpoint:gaia_os:r82:take_41:*:*:*:*:*:*",
"matchCriteriaId": "43393362-0C2B-471E-9C0D-03B9D76EA84E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:checkpoint:gaia_os:r82:take_43:*:*:*:*:*:*",
"matchCriteriaId": "9CA8BE4D-C71F-48D7-B780-E355BF9ACA7A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:checkpoint:gaia_os:r82:take_44:*:*:*:*:*:*",
"matchCriteriaId": "055BD4D8-850C-41A0-9ED5-60874CB667B4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:checkpoint:gaia_os:r82:take_60:*:*:*:*:*:*",
"matchCriteriaId": "1F27A6BB-CA50-4448-B116-4B49346C3155",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:checkpoint:gaia_os:r82:take_73:*:*:*:*:*:*",
"matchCriteriaId": "E18BFECE-B786-414E-A2C0-5835F313E2C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:checkpoint:gaia_os:r82:take_91:*:*:*:*:*:*",
"matchCriteriaId": "89455890-9888-41A5-B12B-086EC35297B6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:checkpoint:gaia_os:r82.10:-:*:*:*:*:*:*",
"matchCriteriaId": "50C9BB1A-E214-4018-8849-56F6D9A25968",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:checkpoint:gaia_os:r82.10:take_19:*:*:*:*:*:*",
"matchCriteriaId": "53D0B2C1-59F1-4095-8D46-CE7F3D87BA33",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:checkpoint:gaia_os:r82.10:take_6:*:*:*:*:*:*",
"matchCriteriaId": "2955157B-8C1C-4241-89FF-6588C440954B",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:checkpoint:gaia_embedded:*:*:*:*:*:*:*:*",
"matchCriteriaId": "4BCFEA43-AB81-4485-B6B1-7948FBB3EC5E",
"versionEndExcluding": "r81.10.17",
"versionStartIncluding": "r80.20.00",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:checkpoint:gaia_embedded:r81.10.17:-:*:*:*:*:*:*",
"matchCriteriaId": "FA48FB0C-7CE1-475D-B685-FF59593C00F7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:checkpoint:gaia_embedded:r81.10.17:build_996004508:*:*:*:*:*:*",
"matchCriteriaId": "F822BD5E-8829-4752-A979-81D0608FADBE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:checkpoint:gaia_embedded:r81.10.17:build_996004620:*:*:*:*:*:*",
"matchCriteriaId": "F1A17167-24E5-4A3A-9C72-390518F1E092",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:checkpoint:gaia_embedded:r81.10.17:build_996004653:*:*:*:*:*:*",
"matchCriteriaId": "E5A0620A-3F9E-4044-87CC-C6382308B59F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:checkpoint:gaia_embedded:r81.10.17:build_996004721:*:*:*:*:*:*",
"matchCriteriaId": "DB03BA80-3775-44AB-AA24-0D3F381846B6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:checkpoint:gaia_embedded:r81.10.17:build_996004892:*:*:*:*:*:*",
"matchCriteriaId": "92DF5CB3-6368-452F-9E57-1D18D238D2BB",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:checkpoint:quantum_spark_1530:-:*:*:*:*:*:*:*",
"matchCriteriaId": "FD21C289-F0A7-40B1-ABA6-DE973A5C12FB",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:checkpoint:quantum_spark_1550:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0691ED2B-98E4-4BEF-88CD-90737C7B54CD",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:checkpoint:quantum_spark_1570:-:*:*:*:*:*:*:*",
"matchCriteriaId": "9787C7C5-FCB2-424A-B593-0216CE86808F",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:checkpoint:quantum_spark_1570r:-:*:*:*:*:*:*:*",
"matchCriteriaId": "6F000ECB-4189-4B32-8699-421A67C17BDB",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:checkpoint:quantum_spark_1590:-:*:*:*:*:*:*:*",
"matchCriteriaId": "C68DBC96-4248-41AE-8581-8C792ED0A58D",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:checkpoint:quantum_spark_1595r:-:*:*:*:*:*:*:*",
"matchCriteriaId": "61E5A939-A111-401E-A718-0562F3DA6C35",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:checkpoint:quantum_spark_1600:-:*:*:*:*:*:*:*",
"matchCriteriaId": "194E2E0B-23E3-4175-805D-506DF5C491DB",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:checkpoint:quantum_spark_1800:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0ECBC553-2864-40D2-8EF3-B15BB002ECEE",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:checkpoint:quantum_spark_1900:-:*:*:*:*:*:*:*",
"matchCriteriaId": "69D14FCF-84E2-41A1-9EBF-6264F1AFD85A",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:checkpoint:quantum_spark_2000:-:*:*:*:*:*:*:*",
"matchCriteriaId": "D5A672E9-4243-4852-9B91-B0393C98C471",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:checkpoint:gaia_embedded:*:*:*:*:*:*:*:*",
"matchCriteriaId": "7B6DC80E-B339-4678-BC76-56D06AFDF102",
"versionEndExcluding": "r82.00.10",
"versionStartIncluding": "r80.20.00",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:checkpoint:gaia_embedded:r82.00.10:-:*:*:*:*:*:*",
"matchCriteriaId": "DECDEDBC-6CEF-45A6-8EEE-C6E053502BEF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:checkpoint:gaia_embedded:r82.00.10:build_998001559:*:*:*:*:*:*",
"matchCriteriaId": "C413370D-0432-485C-BEA1-3D4F95486DF1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:checkpoint:gaia_embedded:r82.00.10:build_998001562:*:*:*:*:*:*",
"matchCriteriaId": "9DE1FA66-FD77-4117-9993-A84D871F3B4B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:checkpoint:gaia_embedded:r82.00.10:build_998002110:*:*:*:*:*:*",
"matchCriteriaId": "2DAB048C-BF9F-4B60-B99B-21CF61FBD377",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:checkpoint:gaia_embedded:r82.00.10:build_998002112:*:*:*:*:*:*",
"matchCriteriaId": "49932FF8-7281-4F6F-85F9-66A3BF1BCF29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:checkpoint:gaia_embedded:r82.00.10:build_998002133:*:*:*:*:*:*",
"matchCriteriaId": "B51A9398-AA4B-407B-9EE6-1C253E99C8CA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:checkpoint:gaia_embedded:r82.00.10:build_998002203:*:*:*:*:*:*",
"matchCriteriaId": "F0C5B191-9167-4DD8-89F8-1526AA6B37BA",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:checkpoint:quantum_spark_1535:-:*:*:*:*:*:*:*",
"matchCriteriaId": "603082FA-896F-4F43-9298-EA821AC8746D",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:checkpoint:quantum_spark_1555:-:*:*:*:*:*:*:*",
"matchCriteriaId": "D432C69F-B100-4D29-AD10-D02DF4D637F6",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:checkpoint:quantum_spark_1575:-:*:*:*:*:*:*:*",
"matchCriteriaId": "D826E703-003D-449C-B190-801FD99CF832",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:checkpoint:quantum_spark_1575r:-:*:*:*:*:*:*:*",
"matchCriteriaId": "618E00E8-09D7-4A64-905F-04650781DB63",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:checkpoint:quantum_spark_2530:-:*:*:*:*:*:*:*",
"matchCriteriaId": "D363A133-C9E8-4289-9D51-A8284ABF0E9B",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:checkpoint:quantum_spark_2550:-:*:*:*:*:*:*:*",
"matchCriteriaId": "492D42C7-BA79-42AC-903E-5A3EF4D00BDA",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:checkpoint:quantum_spark_2560:-:*:*:*:*:*:*:*",
"matchCriteriaId": "3FE64FE4-F3C6-4924-8E65-BC336D416739",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:checkpoint:quantum_spark_2570:-:*:*:*:*:*:*:*",
"matchCriteriaId": "707EC21A-2F9B-4E72-9C60-4382C736D191",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:checkpoint:quantum_spark_2580:-:*:*:*:*:*:*:*",
"matchCriteriaId": "994F4EE1-1ADE-4EA3-AD9A-840E96C353A1",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:checkpoint:quantum_spark_2590:-:*:*:*:*:*:*:*",
"matchCriteriaId": "C49FBD30-C627-4DDC-90B0-F0C4E6DD927C",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A logic flow weakness in Remote Access and Mobile Access certificate validation in deprecated IKEv1 key exchange allows an unauthenticated remote attacker to bypass user authentication and establish a remote access VPN connection without a valid user password."
},
{
"lang": "es",
"value": "Una debilidad en el flujo l\u00f3gico en la validaci\u00f3n de certificados de Acceso Remoto y Acceso M\u00f3vil en el intercambio de claves IKEv1 obsoleto permite a un atacante remoto no autenticado eludir la autenticaci\u00f3n de usuario y establecer una conexi\u00f3n VPN de acceso remoto sin una contrase\u00f1a de usuario v\u00e1lida."
}
],
"id": "CVE-2026-50751",
"lastModified": "2026-08-04T05:16:39.710",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 4.7,
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-50751",
"options": [
{
"exploitation": "active"
},
{
"automatable": "yes"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-08T00:00:00+00:00",
"version": "2.0.3"
}
}
]
},
"published": "2026-06-08T12:16:32.367",
"references": [
{
"source": "cve@checkpoint.com",
"tags": [
"Mitigation",
"Patch",
"Vendor Advisory"
],
"url": "https://support.checkpoint.com/results/sk/sk185033"
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"tags": [
"Vendor Advisory"
],
"url": "https://blog.checkpoint.com/security/check-point-releases-important-hotfix-for-vulnerabilities-in-deprecated-ikev1-vpn-protocol/"
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"tags": [
"US Government Resource"
],
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-50751"
}
],
"sourceIdentifier": "cve@checkpoint.com",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-287"
}
],
"source": "cve@checkpoint.com",
"type": "Secondary"
}
]
}
},
"redhat_vex": {
"current_release_date": "2026-06-10T14:59:43+00:00",
"cve": "CVE-2026-50751",
"id": "CVE-2026-50751",
"initial_release_date": "2026-01-01T00:00:00+00:00",
"product_status:known_not_affected": "1",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "User Authentication Bypass in VPN Remote Access and Mobile Access",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-50751.json",
"version": "3"
},
"vulnrichment": {
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-50751",
"options": [
{
"Exploitation": "active"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-09T03:55:36.834802Z",
"version": "2.0.3"
},
"type": "ssvc"
}
},
{
"other": {
"content": {
"dateAdded": "2026-06-08",
"reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-50751"
},
"type": "kev"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-08T16:01:50.476Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://blog.checkpoint.com/security/check-point-releases-important-hotfix-for-vulnerabilities-in-deprecated-ikev1-vpn-protocol/"
},
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-50751"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Quantum Security Gateway",
"vendor": "checkpoint",
"versions": [
{
"status": "affected",
"version": "R82.10 with Jumbo Hotfix Take 19 or below"
},
{
"status": "affected",
"version": "R82 with Jumbo Hotfix Take 103 or below"
},
{
"status": "affected",
"version": "R81.20 with Jumbo Hotfix Take 141 or below"
},
{
"status": "affected",
"version": "R81.10, R81, and R80.40"
}
]
},
{
"product": "Spark Firewalls",
"vendor": "checkpoint",
"versions": [
{
"status": "affected",
"version": "R80.20.X, R81.10.X, and R82.00.X"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A logic flow weakness in Remote Access and Mobile Access certificate validation in deprecated IKEv1 key exchange allows an unauthenticated remote attacker to bypass user authentication and establish a remote access VPN connection without a valid user password."
}
],
"metrics": [
{
"format": "CVSS",
"other": {
"content": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"type": "CVSSv4.0"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287: Improper Authentication.",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-08T11:07:15.746Z",
"orgId": "897c38be-0345-43cd-b6cf-fe179e0c4f45",
"shortName": "checkpoint"
},
"references": [
{
"url": "https://support.checkpoint.com/results/sk/sk185033"
}
],
"title": "User Authentication Bypass in VPN Remote Access and Mobile Access"
}
},
"cveMetadata": {
"assignerOrgId": "897c38be-0345-43cd-b6cf-fe179e0c4f45",
"assignerShortName": "checkpoint",
"cveId": "CVE-2026-50751",
"datePublished": "2026-06-08T11:07:15.746Z",
"dateReserved": "2026-06-07T09:42:08.251Z",
"dateUpdated": "2026-06-10T13:37:27.725Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…