ZeroDay Findings
Sign inSign up

Findings

CVE-2026-50751

Check Point Security Gateway Improper Authentication Vulnerability

Published Jun 8, 2026 · updated Aug 3, 2026 · Check Point Security Gateway

A logic flow weakness in Remote Access and Mobile Access certificate validation in deprecated IKEv1 key exchange allows an unauthenticated remote attacker to bypass user authentication and establish a remote access VPN connection without a valid user password.

Timeline

Detection, updates, and resolution for this record.

  1. Jun 8, 2026 · Catalog

    Detected

    A logic flow weakness in Remote Access and Mobile Access certificate validation in deprecated IKEv1 key exchange allows an unauthenticated remote attacker to bypass user authentication and establish a remote access VPN connection without a valid user password.

  2. Jun 8, 2026 · CISA KEV

    Known exploited

    Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

  3. Jun 11, 2026 · CISA KEV

    Remediation due

    Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

  4. Aug 3, 2026 · Catalog

    Updated

    A logic flow weakness in Remote Access and Mobile Access certificate validation in deprecated IKEv1 key exchange allows an unauthenticated remote attacker to bypass user authentication and establish a remote access VPN connection without a valid user password.

Required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CISA due date Jun 11, 2026

Affected

  • cpe checkpoint/gaia embeddedversion unspecified
  • cpe checkpoint/gaia osversion unspecified
  • cpe checkpoint/gaia osr81.20
  • vendor Check Point Security Gatewayversion unspecified

Sources

  • CISA KEVCVE-2026-50751

    Check Point Security Gateway contains an improper authentication vulnerability in IKEv1 key exchange that could allow an unauthenticated remote attacker to bypass user authentication and establish a remote access VPN connection without a valid user password.

    cisa.gov
  • CVE.orgCVE-2026-50751

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2026-50751

    30-day exploitation probability 85.3%

    first.org
  • NIST NVDCVE-2026-50751

    A logic flow weakness in Remote Access and Mobile Access certificate validation in deprecated IKEv1 key exchange allows an unauthenticated remote attacker to bypass user authentication and establish a remote access VPN connection without a valid user password.

    nvd.nist.gov

References