CVE-2026-50751
Published: 08 June 2026
Summary
CVE-2026-50751 is a critical-severity Improper Authentication (CWE-287) vulnerability in Checkpoint Gaia Os. Its CVSS base score is 9.3 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique External Remote Services (T1133); ranked in the top 0.7% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-17 (Remote Access) and AC-3 (Access Enforcement).
Deeper analysis
The vulnerability CVE-2026-50751 is a logic flow weakness in Remote Access and Mobile Access certificate validation during the deprecated IKEv1 key exchange. It affects Check Point products that implement these VPN components, allowing improper handling of authentication flows in an otherwise legacy protocol path.
An unauthenticated remote attacker can exploit the flaw over the network to bypass user authentication checks entirely. Successful exploitation permits the attacker to establish a remote access VPN session without supplying a valid password, resulting in high confidentiality impact and limited integrity exposure as reflected in the CVSS 9.3 score.
Check Point has published a hotfix addressing weaknesses in the deprecated IKEv1 VPN protocol, available via their support portal, and recommends applying the update or disabling the legacy protocol where feasible. The CVE is also catalogued by CISA among known exploited vulnerabilities, indicating confirmed in-the-wild activity.
The associated EPSS score stands at 0.4115 with no material rise from a lower baseline, yet the combination of public advisories and CISA listing warrants renewed attention from organizations still running IKEv1 Remote Access configurations.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-35047
Vulnerability details
A logic flow weakness in Remote Access and Mobile Access certificate validation in deprecated IKEv1 key exchange allows an unauthenticated remote attacker to bypass user authentication and establish a remote access VPN connection without a valid user password.
- CWE(s)
- KEV Date Added
- 08 June 2026
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability enables unauthenticated remote bypass of auth in public-facing IKEv1 VPN (Remote Access/Mobile Access), directly facilitating T1133 External Remote Services and T1190 Exploit Public-Facing Application.
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces authentication decisions for remote VPN sessions, blocking the certificate-validation bypass that allows access without a valid password.
Requires explicit authorization, encryption, and authentication mechanisms for all remote-access VPN connections, directly addressing the IKEv1 Remote Access flaw.
Mandates identification and authentication of organizational users before granting system access, mitigating the unauthenticated VPN session establishment.