TT-CSIRT – 457.10.06.26- Critical Check Point VPN Zero-Day
Please be advised that a critical vulnerability, CVE-2026-50751 has been identified in Check Point Remote Access VPN and Mobile Access solutions. The flaw allows an attacker to bypass user authentication by exploiting a logic weakness in certificate validation during IKEv1 VPN negotiation.
This can allow unauthorized users to establish a remote VPN session without valid credentials, potentially gaining access to internal networks.
Please Note: Check Point has confirmed that this vulnerability is being actively exploited in the wild.
Affected Systems and Configurations
Systems are vulnerable to CVE-2026-50751 if they are running an affected version of Check Point software and all of the following conditions are met:
Conditions
- VPN Remote Access or Mobile Access is enabled
- IKEv1 is enabled for Remote Access VPN connections
- The gateway accepts legacy Remote Access clients
- Machine certificate authentication is not enforced
Affected Versions
| Product | Affected Versions |
| Security Gateways | R82.10 Jumbo Hotfix Take 19 or earlier |
| R82 Jumbo Hotfix Take 103 or earlier | |
| R81.20 Jumbo Hotfix Take 141 or earlier | |
| R81.10 (End of Support) | |
| R81 (End of Support) | |
| R80.40 (End of Support) | |
| Spark Firewalls | R80.20.X (End of Support) |
| R81.10.X | |
| R82.00.X |
Mitigations
Check Point has provided the following mitigation measures to reduce the risk of exploitation of CVE-2026-50751:
- Remove support for legacy Remote Access clients.
- Configure Remote Access VPN authentication to use IKEv2 only, thereby disabling IKEv1-based remote access connections.
- Enforce Machine Certificate Authentication by making it mandatory for all Remote Access VPN connections.
Security Updates (Hotfixes)
Check Point has released security hotfixes to address CVE-2026-50751 for supported versions, including R81.20, R82, and R82.10, and organizations are strongly encouraged to apply the appropriate hotfix as soon as possible.
Checkpoint support centre: https://support.checkpoint.com/results/sk/sk185033
Reference(s):
https://support.checkpoint.com/results/sk/sk185033
https://nvd.nist.gov/vuln/detail/CVE-2026-50751
https://www.runzero.com/blog/check-point-devices
Contact Information:
If you have any queries, comments or require assistance, please feel free to contact the TT-CSIRT via contacts@ttcsirt.gov.tt
