CVE-2026-50751: Check Point VPN IKEv1 Auth Bypass, CVSS 9.3

This week in our InSEKurity of the Week series: a critical, unauthenticated authentication bypass in the Remote Access VPN of Check Point Security Gateway — the perimeter security platform that fronts the networks of a huge share of the world’s enterprises, governments, and critical-infrastructure operators. Tracked as CVE-2026-50751 and scored CVSS 9.3 (Critical), the flaw lives in the deprecated IKEv1 key exchange and lets a remote attacker establish a VPN session without a valid user password. This is not a theoretical bug: it was exploited as a zero-day since at least May 7, 2026, a Qilin ransomware affiliate has been tied to post-compromise activity, and CISA added it to the Known Exploited Vulnerabilities (KEV) catalog with a mandatory federal remediation deadline. If you run Check Point Remote Access or Mobile Access with IKEv1 enabled, this one belongs at the very top of your patch queue.

🚨 Summary

CVE ID: CVE-2026-50751
CVSS Score: 9.3 (Critical)
CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N (per Check Point; see advisory SK185033 for the authoritative vector)
CWE: CWE-287 (Improper Authentication)
Affected Software: Check Point Security Gateway — Remote Access VPN, Mobile Access (SSL VPN), and Spark Firewall — only when the deprecated IKEv1 key exchange is enabled
Attack Vector: Network (remote, unauthenticated) — crafted IKEv1 Main Mode exchange to the VPN gateway
Authentication Required: None
User Interaction: None
Impact: Bypass of certificate/user authentication to establish a Remote Access VPN session as a legitimate user, providing a foothold inside the corporate network
Patch Status: ✅ Hotfixes available (SK185033)
Published: June 8, 2026 (Check Point advisory)
Exploitation Status: Actively exploited as a zero-day since May 7, 2026 — linked to a Qilin ransomware affiliate
CISA KEV: ✅ Listed (added June 8, 2026; FCEB remediation due June 11, 2026)

🛡️ What is Check Point Security Gateway?

Check Point Security Gateway is the enforcement engine of Check Point’s network security platform — the firewall, VPN concentrator, and threat-prevention appliance that sits at the network perimeter and inspects, filters, and terminates traffic. It is one of the most widely deployed enterprise firewall and VPN products in the world, protecting enterprises, banks, hospitals, manufacturers, and government agencies of every size. Among its core functions is Remote Access VPN (and the browser-based Mobile Access / SSL VPN portal), which lets employees and contractors tunnel into the corporate network from anywhere.

Remote Access VPN negotiates encrypted tunnels using the Internet Key Exchange (IKE) protocol. Modern deployments use IKEv2, but Check Point gateways still support the legacy IKEv1 key exchange for backward compatibility with older clients and configurations. IKEv1 is deprecated — and it is precisely this old, still-enabled code path that CVE-2026-50751 lives in. Because a VPN gateway is the literal front door to the internal network, an authentication bypass here hands an attacker exactly what every intruder wants first: a trusted position inside the perimeter.

Typical Use Cases

Remote workforce access: employees and contractors connecting to internal applications, file shares, and systems from home or on the road.
Site-to-site and client VPN: secure tunnels between offices, data centers, and cloud environments.
Mobile Access portal: clientless, browser-based access to internal web apps and resources.
Perimeter firewalling and threat prevention: IPS, application control, and traffic inspection at the network edge.
Branch and SMB protection: Spark appliances securing smaller sites with the same VPN feature set.

Because the Security Gateway is a tier-0, internet-facing trust boundary — and Remote Access VPN is deliberately exposed to the public internet so remote users can reach it — an unauthenticated bug in its VPN authentication is about as serious as it gets.

🔍 Technical Analysis

Vulnerability Description

CVE-2026-50751 is an improper authentication flaw (CWE-287) in how Check Point’s Remote Access and Mobile Access components validate certificates during the IKEv1 key exchange. The handshake is supposed to cryptographically verify that the connecting client presents a valid, trusted certificate and signature before it is treated as an authenticated user. Due to a logic flaw, an attacker can convince the gateway to skip that verification entirely and be authenticated as a legitimate user — without a valid password and without a cryptographically valid certificate. The result is a fully established Remote Access VPN session and an internal IP address inside the corporate network.

The vulnerability only affects gateways meeting specific (but common, legacy) conditions: the deprecated IKEv1 key exchange is enabled, legacy Remote Access clients are accepted, and machine-certificate authentication is not mandatory. Where those boxes are ticked — and many long-lived deployments tick them for backward compatibility — the bypass works pre-authentication, over both UDP/500 and TCP/443 (via Visitor Mode’s TCPT transport).

Root Cause Analysis

Independent analysis (watchTowr Labs) pinned the flaw down to letting the client decide whether the client needs to authenticate. The decisive details:

Authentication is gated by a flags word: two critical checks are controlled by bits in a single flags field in the connection state (at offset state + 0x4bc4). Bit 0x2 gates signature verification in the gateway’s process_auth_pl routine; bit 0x4 short-circuits verifyMessagePhase1 inside verify_peer_auth. When either bit is set, authentication is skipped.
The client controls those flags: the gateway reads the flag value straight out of an attacker-supplied VPNExtFeatures Vendor ID payload. It locates a fixed magic identifier (3c f1 87 b2 47 40 29 ea 46 ac 7f d0 ea f2 89 f5) and copies the four bytes immediately following it directly into the flags field:
```
uint cap = *(uint *)(vid + 16);
*(uint *)(state + 0x4bc4) = bswap32(cap);
```
No trust boundary on attacker input: by sending a Vendor ID whose trailing bytes are 0x00000004, the attacker sets bit 0x4 and the gateway never verifies the signature.
No certificate chain validation: the attacker can present a self-signed X.509 certificate — no chain validation occurs — and a random, garbage signature that is never checked.
Deprecated-but-enabled code path: this all lives in the legacy IKEv1 implementation that remains active on gateways kept compatible with older clients.
Transport-agnostic reachability: the bypass works over UDP/500 and over TCP/443 (Visitor Mode), affecting three of the four certificate-authentication modes.

Attack Vector

To weaponize the bypass, an attacker needs only two pieces of low-friction reconnaissance, both readable without credentials, then a crafted IKEv1 Main Mode exchange. The snippet below is illustrative only — it shows the shape of the attack and the reconnaissance, not a working exploit:

# Step 1: Discover internet-facing Check Point Remote Access / Mobile Access
# gateways. IKE listens on UDP/500; the VPN/portal is reachable on TCP/443.
nmap -sU -p 500 --open -oG ike-candidates.gnmap 203.0.113.0/24
nmap -sT -p 443 --open -oG portal-candidates.gnmap 203.0.113.0/24

# Step 2: Read the ICA "organization" string from the gateway's PUBLIC TLS
# certificate -- it is presented to anyone who connects, no auth required.
echo | openssl s_client -connect <gateway-host>:443 2>/dev/null \
    | openssl x509 -noout -subject -issuer

# Step 3: Obtain a valid username. Usernames are discoverable via the
# gateway's own probe/response behaviour during VPN negotiation.

# Step 4: Craft a malicious IKEv1 Main Mode exchange. ILLUSTRATIVE ONLY --
# this does NOT implement CVE-2026-50751. The real exploit sends:
#   - a self-signed X.509 cert (no chain validation is performed)
#   - a random/garbage signature (it is never verified)
#   - a VPNExtFeatures Vendor ID payload whose trailing 4 bytes are
#     0x00000004, setting the "skip signature verification" flag bit.
# The gateway then authenticates the attacker as the chosen user and
# returns a session key plus an internal IP address.

A simplified view of the attack chain:

Attacker                                    Victim (Check Point Security Gateway)
   |                                                        |
   |  read ICA org string from public TLS cert (TCP/443)    |
   |------------------------------------------------------->|  no auth required
   |                                                        |
   |  IKEv1 Main Mode: self-signed cert + garbage signature  |
   |  + VPNExtFeatures Vendor ID (trailing bytes 0x00000004) |
   |------------------------------------------------------->|  flag bit 0x4 set
   |                                                        |  -> signature check
   |                                                        |     is SKIPPED
   |                                                        |
   |<-- authenticated as a valid user + session key --------|  internal IP issued
   |                                                        |
   |  attacker is now INSIDE the corporate network --------> |  foothold for
   v                                                        v  lateral movement

The flow above is illustrative only — it does not implement CVE-2026-50751. The actual exploit abuses the gateway’s trust in a client-supplied Vendor ID flag to skip IKEv1 signature verification, allowing authentication with an invalid certificate and signature.

Exploitation in the Wild

2026-05-07 — Earliest observed exploitation. The flaw was used as a zero-day weeks before any advisory existed.
Early May 2026 — First documented attacks, including a financially motivated intrusion later attributed to a Qilin ransomware affiliate that used Tox for C2 communications and Rclone for data exfiltration, operating from dedicated VPS infrastructure.
2026-06-04 — Check Point detects suspicious activity and opens an investigation.
2026-06-08 — Check Point publishes the security advisory and emergency hotfix; CISA adds CVE-2026-50751 to the KEV catalog the same day, with a mandatory FCEB remediation deadline of June 11, 2026.
Early June 2026 — Exploitation attempts escalate; security vendors (Rapid7 and others) confirm additional cases. Observed activity remains a targeted campaign against a few dozen organizations globally, with correlations noted between victim geography and attacker VPS geolocation.

Post-Exploitation Impact

Authenticated foothold inside the perimeter: the attacker obtains a legitimate VPN session and internal IP — the single most valuable starting position for an intrusion.
Lateral movement: from inside the network, the attacker pivots toward Active Directory, file servers, and crown-jewel systems.
Ransomware deployment: the confirmed Qilin affiliate used the access for data exfiltration (Rclone) and ransomware staging — the textbook double-extortion playbook.
Credential harvesting: an internal position enables capture of additional credentials to broaden and deepen access.
Persistence: rogue VPN access, new accounts, or implants let the attacker return even after the initial session ends.
Stealth: because the attacker authenticates as a “valid user,” the activity blends into legitimate VPN traffic, delaying detection.

⚠️ Impact Assessment

Immediate Impact

Unauthenticated, internet-reachable, perimeter bypass: no credentials and no user interaction — only network access to a public VPN gateway.
High-value, ubiquitous target: Check Point Security Gateway is one of the most widely deployed enterprise firewall/VPN platforms in the world.
Active zero-day exploitation: this was abused in the wild before disclosure, with a ransomware affiliate already weaponizing it.
CISA KEV listed: a mandatory federal remediation deadline signals confirmed, serious exploitation.
Legacy configuration is the trigger: deployments that kept IKEv1 and legacy clients for backward compatibility are exactly the ones at risk.

Affected Versions

Branch	Status	Notes
R80.20.X	End of Support	Vulnerable when IKEv1 enabled — upgrade/migrate urgently
R80.40	End of Support	Vulnerable when IKEv1 enabled — upgrade/migrate urgently
R81	End of Support	Vulnerable when IKEv1 enabled — upgrade/migrate urgently
R81.10	End of Support	Vulnerable when IKEv1 enabled — upgrade/migrate urgently
R81.10.X	Affected	Apply hotfix (SK185033)
R81.20	Affected	Apply hotfix (SK185033)
R82 / R82.00.X	Affected	Apply hotfix (SK185033)
R82.10	Affected	Apply hotfix (SK185033)

The vulnerability only applies when the deprecated IKEv1 key exchange is enabled, legacy Remote Access clients are accepted, and machine-certificate authentication is not mandatory. Check Point advisory SK185033 is the authoritative source for exact fixed builds and per-version hotfixes — always cross-reference it before deploying. (Related advisory SK185035 covers CVE-2026-50752.)

Affected Environments

Any organization running Check Point Remote Access / Mobile Access with IKEv1 enabled: the deprecated key exchange is the trigger condition.
Long-lived deployments: gateways kept on legacy configurations for backward compatibility with old clients.
Internet-facing VPN concentrators: Remote Access portals are deliberately public, so the attack surface is exposed by design.
End-of-Support branches: R80.20.X/R80.40/R81/R81.10 deployments that are both vulnerable and out of standard support.
Critical-infrastructure and high-value targets: the observed campaign was targeted, and ransomware operators prize VPN footholds.

Attacker Profiles

Ransomware affiliates: as already demonstrated by the Qilin-linked intrusions — a perimeter bypass is an ideal ransomware entry point.
Initial-access brokers: unauthenticated VPN access into enterprises is premium, resellable access.
APT groups: a quiet, authenticated foothold inside the perimeter is perfect for espionage and long-dwell operations.
Opportunistic scanners: with the flaw public and KEV-listed, internet-facing Check Point gateways will be swept en masse.

🛡️ Mitigation Strategies

Immediate Actions (Priority 1) ⚡

Apply the Check Point hotfix to every affected gateway immediately. Follow advisory SK185033 for the correct fix per version branch:

# In SmartConsole / Gaia:
#   1. Identify the running version of each Security Gateway.
#   2. Download and install the hotfix referenced in SK185033 for that
#      branch (R81.10.X, R81.20, R82, R82.00.X, R82.10).
#   3. End-of-Support branches (R80.20.X, R80.40, R81, R81.10) must be
#      upgraded/migrated to a supported, fixed release.

If you cannot patch immediately, disable IKEv1 and remove legacy-client support. The flaw only applies to the deprecated IKEv1 path, so disabling it removes the attack surface:

# In SmartConsole, on the Remote Access / Mobile Access configuration:
#   - Disable the deprecated IKEv1 key exchange (enforce IKEv2 only).
#   - Remove support for legacy Remote Access clients.
#   - Make machine-certificate authentication MANDATORY.
# Validate that all production clients negotiate IKEv2 before enforcing.

Determine your exposure by checking whether IKEv1 is enabled and reachable:

# IKE listens on UDP/500. Confirm whether your gateway answers IKEv1
# negotiation from untrusted networks (it should not, post-mitigation).
nmap -sU -p 500 --script ike-version <gateway-host>

# Confirm the Remote Access portal is reachable on TCP/443 (expected for
# remote users) and inventory which gateways expose it to the internet.
curl -sk -o /dev/null -w "Portal HTTP status: %{http_code}\n" \
    "https://<gateway-host>/sslvpn/Login/Login"

Conduct a forensic audit back to May 7, 2026. Because this was an active zero-day, patching alone is not enough — assume possible prior compromise:

# Review VPN/authentication logs for IKEv1 Main Mode sessions that
# authenticated successfully with anomalous client characteristics, and
# for VPN logins from the known attacker IP ranges and unusual geos.
grep -iE "IKEv1|Main Mode|Remote Access" vpn-auth.log \
    | grep -iE "auth|login|established" \
    | awk '{print $1, $2, $5, $9}'

Block the known indicators of compromise at the perimeter and hunt for them internally (attacker IPs were hosted on Kaupo Cloud HK, Shock Hosting, and Vultr; ELF-payload retrieval hashes were observed). Pull the current IoC list from the Check Point and Rapid7 write-ups and load it into your firewall and SIEM.

Detection Measures 🔍

# Build detections around:
#   - Successful IKEv1 Main Mode authentications using certificate auth,
#     especially with self-signed or otherwise anomalous client certs.
#   - VPN logins from the published attacker IP ranges / hosting providers
#     (Kaupo Cloud HK, Shock Hosting, Vultr) and from unexpected geos.
#   - "Impossible travel" or out-of-baseline VPN sessions for known users.
#   - Outbound Tox-protocol C2 patterns and Rclone data-exfiltration
#     behaviour originating from hosts reached via VPN.
#   - New or rogue VPN accounts / certificates created post-intrusion.

Network-side hunting:

Alert on inbound UDP/500 IKEv1 negotiation from untrusted sources to gateways that should be IKEv2-only.
Watch for VPN sessions immediately followed by internal reconnaissance (port scans, AD enumeration) — a strong post-bypass signal.
Deploy Check Point IPS signatures and any vendor IDS/IPS coverage for CVE-2026-50751 as it becomes available, and ingest published IoCs.

Long-term Security Improvements

Retire deprecated protocols: IKEv1 should be disabled everywhere it is not strictly required; enforce IKEv2-only.
Mandate machine-certificate authentication: removing optional/weak auth modes closes the conditions this bypass depends on.
Keep perimeter devices on supported releases: End-of-Support branches (R80.20.X/R80.40/R81/R81.10) must be migrated — they receive no routine fixes.
Treat VPN gateways as tier-0: rapid critical-patch SLAs, tight monitoring, and least-exposure configuration for all internet-facing security appliances.
Assume-breach for perimeter zero-days: when an internet-facing device has an active zero-day, patch and hunt — don’t assume a clean state.
Continuously inventory internet-facing services: know exactly which gateways expose Remote Access/Mobile Access and on which versions.

🎯 Why is this Critical?

Unauthenticated perimeter bypass: no credentials, no user interaction — just a crafted IKEv1 exchange yields an authenticated VPN session inside the network.
Active zero-day, exploited before disclosure: abused in the wild since at least May 7, 2026.
Ransomware in play: a Qilin affiliate has already used it for data theft and ransomware staging.
CISA KEV listed with a federal deadline: confirmation of serious, real-world exploitation.
Ubiquitous, high-value target: Check Point gateways protect enterprises, governments, and critical infrastructure worldwide.
Internet-exposed by design: Remote Access VPN must be reachable from the internet, so vulnerable gateways are directly attackable.
A clean patch and a clean workaround exist: the SK185033 hotfix fixes it, and disabling IKEv1 removes the surface entirely — there is no excuse to leave it exposed.

🚀 Timeline and Disclosure

2026-05-07 — Earliest observed in-the-wild exploitation of CVE-2026-50751 as a zero-day.
Early May 2026 — First documented attacks; a Qilin ransomware affiliate is later linked to post-compromise activity (Tox C2, Rclone exfiltration, dedicated VPS infrastructure).
2026-06-04 — Check Point detects suspicious activity and begins investigating.
2026-06-08 — Check Point publishes the advisory and emergency hotfix (SK185033); CISA adds the CVE to the KEV catalog, with a mandatory FCEB remediation deadline of June 11, 2026.
Early-to-mid June 2026 — Exploitation escalates; Rapid7 and others confirm additional cases. Activity remains a targeted campaign against a few dozen organizations globally.

🔗 Resources and References

CVE: CVE-2026-50751
NVD: NVD — CVE-2026-50751
Check Point Advisory: Check Point Releases Important Hotfix for Vulnerabilities in Deprecated IKEv1 VPN Protocol (SK185033)
CWE: CWE-287: Improper Authentication
CISA KEV Catalog: Known Exploited Vulnerabilities

💼 SEKurity Supports You

Vulnerabilities like CVE-2026-50751 are a reminder that the perimeter device you trust the most — the VPN gateway that decides who gets inside your network — is exactly where attackers aim first, because one bug there bypasses every internal control behind it. A logic flaw in a deprecated-but-still-enabled protocol turned Check Point’s front door into an open door, and a ransomware crew walked straight through it. We help organizations find the legacy options and deprecated protocols still quietly enabled on their perimeter, validate that internet-facing appliances are genuinely patched and hardened, and stress-test whether an attacker who reached the inside of your network would be detected before it became a ransomware incident. Our perimeter and Red Team engagements map exactly these forgotten doors — before someone with a zero-day finds them first.

Our Services

Penetration Testing: Web applications, mobile apps (Android & iOS), SAP systems, Active Directory
Large-Scale Attacks: Perimeter testing, IT infrastructure testing, Red Team engagements
Security Awareness: Phishing campaigns, hacking demonstrations

Act now — before attackers do.

Contact:

🌐 Website: www.sekurity.de

📧 Inquiries: www.sekurity.de/kontakt

📱 LinkedIn: SEKurity GmbH

Your SEKurity Team — Your Trusted Adversaries

The security of your perimeter infrastructure is our drive.

InSEKurity of the Week (CW24/2026): Check Point Remote Access VPN IKEv1 Authentication Bypass (CVE-2026-50751)