VULNpocalypse
CriticalVulnerabilityPatch available

Check Point Remote Access VPN CVE-2026-50751: IKEv1 authentication bypass exploited since May 2026

An IKEv1 flaw lets attackers open Check Point remote access VPN sessions with no password. Exploited since 7 May 2026. Install sk185033 or force IKEv2.

Published
Updated
Fixed in
Jumbo Hotfix R82.10 Take 24, R82 Take 107, R81.20 Take 146, R81.10 Take 187, or the sk185033 hotfix; Spark R82.00.10 Build 998002216, R81.10.17 Build 996004901
Exploitation
Yes. Check Point saw exploitation from 7 May 2026, one case tied to a Qilin affiliate; in CISA KEV since 8 June 2026, marked as used by ransomware

Live scores

CVE-2026-50751
EPSS
0.853
very likely to be attacked soon
VEDAS
0.984
strong exploit evidence
On CISA KEV
Yes, since 2026-06-08
Detection rule
None yet
EPSS (chance of attack)
100.1CVE-2026-50751 EPSS over time2026-082026-11-01
VEDAS (exploit evidence)
100.9CVE-2026-50751 VEDAS over time2026-082026-11-01

Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish.

Live scores

CVE-2026-50752
EPSS
0.050
some chance of attack soon
VEDAS
0.070
little exploit evidence
On CISA KEV
Not listed
Detection rule
None yet

What happened

On 8 June 2026, Check Point disclosed CVE-2026-50751, a “logic flow weakness” in certificate validation for the deprecated IKEv1 key exchange. An unauthenticated attacker can “establish a remote access VPN connection without a valid user password.” It is rated CVSS 9.3 (CVE record; Check Point).

Check Point says exploitation began on 7 May 2026, increased in early June, and was “limited to a few dozen targeted organizations globally.” One case involved follow-on activity linked to a Qilin ransomware affiliate. Check Point also notes that an attacker needs further steps after the VPN session to reach internal resources (Check Point). Rapid7 reported two high-confidence cases of its own and saw attempts to download ELF payloads (Rapid7).

CISA added CVE-2026-50751 to KEV on 8 June with a due date of 11 June, and marks it as known to be used in ransomware campaigns (CISA KEV).

The same release fixed CVE-2026-50752 (CVSS 7.4, sk185035), a related IKEv1 certificate-validation flaw that may allow man-in-the-middle interference with site-to-site VPNs. Check Point has not seen it exploited (Check Point).

Am I affected?

A gateway is vulnerable only when all four are true (sk185033):

  1. Remote Access VPN or Mobile Access is enabled.
  2. IKEv1 is enabled for remote access.
  3. The gateway accepts legacy Remote Access clients (“Allow older clients to connect to this gateway” is ticked).
  4. The gateway does not require a machine certificate.

Vulnerable versions: Security Gateway R82.10 with Jumbo Hotfix Take 19 or below, R82 Take 103 or below, R81.20 Take 141 or below, and the end-of-support R81.10, R81 and R80.40. Spark firewalls R80.20.X, R81.10.X and R82.00.X (sk185033). On a gateway, fw ver shows the release and cpinfo -y all lists the installed Jumbo Hotfix take.

Then look for use. In SmartConsole Logs & Monitor, from at least 7 May 2026 (sk185033):

  • Search action:"Key Install" AND "Quick Mode completion" for IKEv1 completions. Treat any before you patched or mitigated as suspicious, and check for unknown users or source IPs.
  • Search for these attacker addresses as source or destination: 45.77.149.152, 209.182.225.136, 38.60.157.139, 162.33.177.101, 45.76.26.42, 144.208.127.155, 38.54.88.201, 38.54.107.167, 66.42.99.200, 45.63.104.106, 45.61.136.173, 146.71.81.184, 208.123.119.167, 64.176.228.109, 158.247.195.147, 144.208.127.134.
  • Rapid7 lists two MD5 hashes: 52fda5c1b9704544f32ee98d9060e689 and 51d39aa39478beeac94f2d12f682ecce (Rapid7).

What to do now

  1. Install the fix. Jumbo Hotfix R82.10 Take 24, R82 Take 107, R81.20 Take 146 or R81.10 Take 187, or the sk185033 hotfix for your current take. Spark: R82.00.10 Build 998002216 or R81.10.17 Build 996004901. For centrally managed Spark, first update the management server with the fix in sk184766 (sk185033). R81, R80.40 and R80.20.X are out of support; plan a move to a supported release.
  2. If you cannot patch today, force IKEv2. In SmartConsole, go to Global properties > Remote Access > VPN Authentication, tick “IKEv2 only” and install policy. On locally managed Spark, go to WebUI > Device > Advanced Setting and set “Remote Access VPN - Encryption Method” to IKEv2 (sk185033).
  3. Or use one of the two other mitigations. Remove legacy client support: in the gateway object, go to VPN Clients > Authentication, clear “Allow older clients to connect to this gateway” (and the same box under Mobile Access > Authentication), and install policy; this blocks clients such as StrongSWAN and L2TP. Or require machine certificates: in VPN Clients > Authentication, set Machine Certificate Authentication to “Mandatory” and install policy (sk185033).
  4. Turn on the IPS protection “IKEv1 Remote Access Authentication Bypass PoC Exploit (CVE-2026-50751)” for visibility. It does not fix the flaw (sk185033).
  5. Hunt even after patching. Rapid7 “strongly recommends looking for signs of compromise even after the hotfix has been applied” (Rapid7). For every suspicious VPN session, trace what the assigned office-mode IP touched inside the network. Check Point’s hunting guide is linked from sk185033.
  6. Install the CVE-2026-50752 fix (sk185035) if you run IKEv1 site-to-site tunnels.

Sources