CVE-2026-50751: Checkpoint Gaia OS Auth Bypass Flaw

CVE-2026-50751 Overview

CVE-2026-50751 is an authentication bypass vulnerability [CWE-287] affecting Check Point Gaia OS, Gaia Embedded, and Quantum Spark appliances. A logic flow weakness in the Remote Access and Mobile Access certificate validation routine within the deprecated IKEv1 key exchange allows an unauthenticated remote attacker to establish a VPN session without providing a valid user password. The vulnerability is network-reachable and requires no user interaction. CISA has added CVE-2026-50751 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation. The EPSS probability is 11.841% at the 93.88 percentile.

Critical Impact
Unauthenticated attackers can bypass user authentication on Check Point Remote Access and Mobile Access VPN gateways and establish an authenticated remote access tunnel into the protected network.

Affected Products

Check Point Gaia OS R81.20 and R82 (multiple Take builds), and Gaia OS R82.10
Check Point Gaia Embedded R81.10.17 and R82.00.10 builds
Check Point Quantum Spark 1530/1535/1550/1555/1570/1570R/1575/1575R/1590/1595R/1600/1800/1900/2000/2530/2550/2560/2570/2580/2590 appliances

Discovery Timeline

2026-06-08 - CVE-2026-50751 published to NVD
2026-06-09 - Last updated in NVD database
2026-06-11 - EPSS scoring updated, reflecting elevated exploitation likelihood

Technical Details for CVE-2026-50751

Vulnerability Analysis

The flaw resides in the certificate validation logic invoked during IKEv1 (Internet Key Exchange version 1) negotiation for Check Point Remote Access and Mobile Access VPN portals. IKEv1 has been deprecated by Check Point but remains enabled in many production gateway configurations for legacy client compatibility. During Phase 1 negotiation, the gateway evaluates the supplied certificate to identify and authenticate the user. A logic flow weakness in this path causes the gateway to treat certificate-based identification as sufficient proof of authentication, bypassing the secondary password challenge that should follow.

An unauthenticated remote attacker who can reach the VPN service over the network can complete the IKEv1 exchange and establish a tunnel as a valid user without ever supplying the user's password. The scope is changed because the established VPN session grants access to resources behind the gateway, extending impact beyond the appliance itself.

Root Cause

The root cause is improper authentication [CWE-287] in the deprecated IKEv1 handler. The certificate validation routine returns a success state that the upstream authentication state machine interprets as a completed credential check, omitting password verification for Remote Access and Mobile Access users.

Attack Vector

Exploitation requires only network reachability to the VPN gateway on the IKE UDP ports (typically UDP/500 and UDP/4500). The attacker initiates an IKEv1 Phase 1 negotiation against a gateway with IKEv1 enabled for Remote Access or Mobile Access, supplies a crafted certificate payload that satisfies the flawed validation path, and completes the exchange without providing valid user credentials. No prior account, no user interaction, and no elevated privileges are required.

No public proof-of-concept code has been published. The vulnerability is described in prose only; refer to the Check Point Support Article (sk185033) and the Check Point Hotfix Announcement for vendor-supplied technical context.

Detection Methods for CVE-2026-50751

Indicators of Compromise

Successful IKEv1 Phase 1 and Phase 2 completions on UDP/500 or UDP/4500 from source IPs that do not appear in normal Remote Access user telemetry.
VPN session establishment events for user accounts without a corresponding password authentication log entry.
Office Mode IP assignments to clients followed by lateral movement attempts toward internal management or directory services.

Detection Strategies

Correlate IKE negotiation logs with downstream authentication logs and alert when an IKEv1 session is established without a matching password-based authentication record.
Hunt for IKEv1 connection attempts from unexpected geographies or from autonomous systems not previously seen connecting to the Remote Access portal.
Inspect Check Point vpnd and iked logs for anomalous certificate subjects, repeated negotiation failures followed by a single success, or rapid session churn.

Monitoring Recommendations

Forward Check Point gateway logs, VPN session events, and authentication records into a centralized analytics platform for correlation and long-term retention.
Monitor east-west traffic originating from VPN Office Mode address ranges for signs of internal reconnaissance against directory services and file shares.
Track the volume of IKEv1 versus IKEv2 negotiations per gateway and alert on unexpected IKEv1 spikes given its deprecated status.

How to Mitigate CVE-2026-50751

Immediate Actions Required

Apply the Check Point hotfix referenced in sk185033 to all affected Gaia OS, Gaia Embedded, and Quantum Spark appliances.
Disable IKEv1 for Remote Access and Mobile Access blades where the hotfix cannot be applied immediately, and require IKEv2 for all remote users.
Audit existing VPN sessions and revoke any active tunnels that cannot be tied to a legitimate authenticated user, then force password rotation for Remote Access users.
Treat affected gateways as priority assets given CISA KEV listing and confirmed exploitation.

Patch Information

Check Point has released a hotfix addressing the IKEv1 authentication bypass. Installation instructions, applicable builds, and version mapping for Gaia OS R81.20, R82, R82.10, Gaia Embedded R81.10.17 and R82.00.10, and Quantum Spark appliances are documented in the Check Point Support Article (sk185033) and summarized in the Check Point Hotfix Announcement. The vulnerability is tracked in the CISA Known Exploited Vulnerabilities Catalog.

Workarounds

Disable the IKEv1 key exchange on Remote Access and Mobile Access gateways and enforce IKEv2-only negotiation.
Restrict inbound UDP/500 and UDP/4500 to known client networks or trusted geographies until the hotfix is deployed.
Enforce multi-factor authentication on the Remote Access portal so that a bypassed password check alone cannot grant network access.
Place affected gateways behind an upstream filtering device that can rate-limit and inspect IKE negotiations.

bash

# Configuration example: disable IKEv1 on a Check Point gateway via CLI
# Reference: Check Point sk185033 for the authoritative procedure
vpn shell
/show ike version
/set ike version v2-only
save config