CVE-2026-50751 is a logic-flow weakness in how Check Point's Remote Access and Mobile Access VPN validates certificates during the deprecated IKEv1 key exchange, letting an unauthenticated remote attacker establish a full remote-access VPN session without ever supplying a valid user password, and Check Point Research has observed active exploitation against dozens of organizations, including one incident tied to Qilin ransomware.
Vulnerability summary
9.3
Critical
85.3%
EPSS score (FIRST)
Yes
CISA KEV catalog
2026-06-08
Published
Vulnerability ID: CVE-2026-50751 · Source: NVD (CISA-ADP Secondary score only, not NVD Primary)
Affected components
| Component | CPE | Version range |
|---|---|---|
| Check Point Quantum Security Gateway (Gaia OS) | cpe:2.3:o:checkpoint:gaia_os:*:*:*:*:*:*:*:* | R80.40, R81, R81.10, R81.20 through Take 141, R82 through Take 103, R82.10 through Take 19 — all fixed by the vendor hotfix |
| Check Point Spark Firewalls (Gaia Embedded) | cpe:2.3:o:checkpoint:gaia_embedded:*:*:*:*:*:*:*:* | R80.20.X, R81.10.X before R81.10.17, and R82.00.X before R82.00.10 — fixed in R81.10.17 / R82.00.10 and later |
What this means
CVE-2026-50751 affects Check Point Quantum Security Gateways and Spark Firewalls. NVD's description states it is "a logic flow weakness in Remote Access and Mobile Access certificate validation in deprecated IKEv1 key exchange" that "allows an unauthenticated remote attacker to bypass user authentication and establish a remote access VPN connection without a valid user password" (NVD).
NVD has not published its own Primary CVSS for this CVE; the only score on record is a Secondary metric (CVSS v3.1 9.3, critical, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N) attributed to a CISA ADP source rather than to NVD's own analysts — network-reachable, low attack complexity, no privileges or user interaction required, scope changed, with high confidentiality impact. CWE-287 (Improper Authentication) is the assigned weakness (NVD).
Check Point's own blog post confirms the vulnerability lies in the deprecated IKEv1 remote-access VPN path and states Check Point Research "identified active exploitation of CVE-2026-50751 in the wild" targeting dozens of organizations globally, with one case linked to Qilin ransomware activity, and exploitation attempts escalating in early June 2026. Check Point released a security hotfix for all affected Security Gateway and Spark Firewall builds, documented in support article SK185033, and separately disclosed a related site-to-site VPN issue (CVE-2026-50752, CVSS 7.4) with no observed wild exploitation (Check Point blog).
CISA added CVE-2026-50751 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-06-08, with an unusually short required-action due date of 2026-06-11, and records knownRansomwareCampaignUse as "Known" (CISA KEV).
As of 2026-10-30, FIRST scores the probability of exploitation at 0.8534 (99.717th percentile), consistent with CISA's three-day remediation window and Check Point's own confirmation of in-the-wild ransomware-linked use (FIRST EPSS).
Any Check Point Quantum Security Gateway or Spark Firewall still relying on IKEv1-based Remote Access or Mobile Access VPN should apply the vendor hotfix immediately and review VPN session logs for signs of unauthenticated access predating the patch.
Evidence
- Logic-flow weakness in IKEv1 certificate validation for Remote Access/Mobile Access VPN lets an unauthenticated remote attacker establish a VPN session without a valid user password. — NVD
- CVSS v3.1 score is 9.3 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N, stored by NVD as a Secondary metric from a CISA ADP source — NVD has not published its own Primary score. — NVD
- Check Point Research confirmed active exploitation in the wild against dozens of organizations, with one incident linked to Qilin ransomware; a hotfix is available for all affected Security Gateway and Spark builds. — Check Point blog
- Added to the CISA Known Exploited Vulnerabilities catalog on 2026-06-08, required action due 2026-06-11; knownRansomwareCampaignUse recorded as "Known". — CISA KEV
- EPSS score is 0.8534 (99.717th percentile) as of 2026-10-30. — FIRST EPSS
