## Summary
CVE-2026-50751 is a critical authentication bypass in Check Point Remote Access and Mobile Access VPN when configured to use the deprecated IKEv1 key exchange. Check Point reports active exploitation in the wild, allowing an unauthenticated attacker to establish a VPN session without a valid user password.
## Technical Details
- Root issue: a logic flow weakness in certificate validation for IKEv1 key exchange used by Remote Access and Mobile Access.
- Attack behavior: an attacker can bypass user authentication and establish a remote access VPN connection without possession of a valid user password.
- Post-authentication: the referenced reporting states additional post-authentication activity is required to access internal resources or escalate privileges.
- Exploitation status: Check Point observed exploitation limited to a few dozen targeted organizations globally; one case included confirmed post-compromise activity associated with a Qilin ransomware affiliate.
- Related issue: Check Point also identified CVE-2026-50752 affecting certificate validation in deprecated IKEv1, with potential man-in-the-middle interference for site-to-site VPN communications under specific conditions (not observed exploited in the wild).
## Affected
- checkpoint gaia os r80.40 - r81.20 (exclusive)
- checkpoint gaia embedded r80.20.00 - r81.10.17 (exclusive)
- Deployments using IKEv1 key exchange for Remote Access and Mobile Access
## Impact
- Unauthenticated attacker can bypass user authentication and establish a remote access VPN connection without a valid user password.
- Potential downstream risk includes access to internal resources or privilege escalation after additional attacker activity.
- Active exploitation has been reported, including ransomware-adjacent post-compromise activity.
## Mitigation
1. Apply the available security updates immediately for affected Check Point VPN components configured with deprecated IKEv1.
2. If updates are unavailable, follow CISA guidance to apply mitigations per vendor instructions or discontinue use of the product.
3. Use the CISA KEV catalog as a prioritization input for remediation planning (CVE listed as known exploited; Date Added: 2026-06-08, Due Date: 2026-06-11).
4. Review exposure to CVE-2026-50752 as well, since it shares the IKEv1 certificate validation area (even though it was not observed exploited in the wild).
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
CWE-287