CVE-2026-50752

A certificate validation weakness in IKEv1 that could let an attacker in a position to intercept traffic interfere with site-to-site VPN connections under specific conditions; Check Point has not seen it exploited.

Affects

Check Point Security Gateways and Spark firewalls (remote access VPN / Mobile Access)

Severity

High · CVSS 7.4

Fixed in

R82.10 Take 24
R82 Take 107
R81.20 Take 146
R81.10 Take 187
Spark R82.00.10 Build 998002216
Spark R81.10.17 Build 996004901

Being used in attacks

Not known to be

Made public

8 June 2026

Part of: Check Point Security Gateway VPN sign-in bypass (CVE-2026-50751) exploited, including by a Qilin ransomware affiliate

CVE-2026-50751 is a critical flaw (CVSS 9.3) in Check Point Security Gateways and Spark firewalls that offer remote-access VPN or Mobile Access using the old IKEv1 key exchange. A fault in certificate checking lets an attacker open a VPN session without a valid user password. Check Point says exploitation began no later than 7 May 2026, was limited to a few dozen targeted organisations, and in one case was followed by activity linked to a Qilin ransomware affiliate. CISA listed it as exploited on 8 June. Check Point published its advisory and a hotfix that day, and a second flaw, CVE-2026-50752 (CVSS 7.4), which it has not seen exploited. Fixes now exist for R82.10, R82, R81.20 and R81.10 and for Spark firewalls. Older end-of-support releases such as R80.40 and R80.20.X have no listed fix. Check Point also offers workarounds: turn off legacy clients, allow IKEv2 only, or require machine certificates. This mostly affects businesses, but home offices using these gateways are covered too.

Fixed in the same update

• CVE-2026-50751Check Point VPN sign-in bypass via IKEv1 certificate check

Sources

1. Check Point releases important hotfix for vulnerabilities in deprecated IKEv1 VPN protocolCheck Point · 8 June 2026
2. CVE-2026-50751: IKEv1 Remote Access Authentication Bypass (sk185033)Check Point · 24 Sept 2026