MSRXVulnerabilities / CVE-2026-50751
CVE-2026-50751
Published 2026-06-08 · Analyzed
CVE-2026-50751
Check Point Security Gateway Improper Authentication Vulnerability
Exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2026-06-08, with a fix-by date of 2026-06-11. Patch it first.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
9.3 CRITICAL
CVSS 3.1 · CNA
CVSS 3.1 · CNA
85%
chance of exploitation in the next 30 days (EPSS; in the top 1% of all CVEs)
chance of exploitation in the next 30 days (EPSS; in the top 1% of all CVEs)
A logic flow weakness in Remote Access and Mobile Access certificate validation in deprecated IKEv1 key exchange allows an unauthenticated remote attacker to bypass user authentication and establish a remote access VPN connection without a valid user password.
Scores
Affected products
- checkpoint gaia os: ≥ r80.40, < r81.20; 57 specific releases listed in NVD
- checkpoint gaia embedded: ≥ r80.20.00, < r81.10.17; ≥ r80.20.00, < r82.00.10; 13 specific releases listed in NVD
Weakness: CWE-287
3 references (advisories, patches, write-ups)
- https://support.checkpoint.com/results/sk/sk185033 · Mitigation, Patch, Vendor Advisory
- https://blog.checkpoint.com/security/check-point-releases-important-hotfix-for-vulnerabilities-in-deprecated-ikev1-vpn-protocol/ · Vendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-50751 · US Government Resource
Sources: NVD, CVE.org, FIRST EPSS. Missing ones did not answer or have no record yet.