Cyber Resilience

CVE-2026-50751

CriticalCISA KEVActive ExploitationRansomware-linkedUpdated

Published: 08 June 2026

Published
08 June 2026
Modified
17 June 2026
KEV Added
08 June 2026
Patch
CVSS Score v3.1 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
EPSS Score 0.7105 99.3th percentile
Risk Priority 100 floored blend · peak EPSS

Summary

CVE-2026-50751 is a critical-severity Improper Authentication (CWE-287) vulnerability in Checkpoint Gaia Os. Its CVSS base score is 9.3 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique External Remote Services (T1133); ranked in the top 0.7% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-17 (Remote Access) and AC-3 (Access Enforcement).

Deeper analysis

The vulnerability CVE-2026-50751 is a logic flow weakness in Remote Access and Mobile Access certificate validation during the deprecated IKEv1 key exchange. It affects Check Point products that implement these VPN components, allowing improper handling of authentication flows in an otherwise legacy protocol path.

An unauthenticated remote attacker can exploit the flaw over the network to bypass user authentication checks entirely. Successful exploitation permits the attacker to establish a remote access VPN session without supplying a valid password, resulting in high confidentiality impact and limited integrity exposure as reflected in the CVSS 9.3 score.

Check Point has published a hotfix addressing weaknesses in the deprecated IKEv1 VPN protocol, available via their support portal, and recommends applying the update or disabling the legacy protocol where feasible. The CVE is also catalogued by CISA among known exploited vulnerabilities, indicating confirmed in-the-wild activity.

The associated EPSS score stands at 0.4115 with no material rise from a lower baseline, yet the combination of public advisories and CISA listing warrants renewed attention from organizations still running IKEv1 Remote Access configurations.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability details

A logic flow weakness in Remote Access and Mobile Access certificate validation in deprecated IKEv1 key exchange allows an unauthenticated remote attacker to bypass user authentication and establish a remote access VPN connection without a valid user password.

CWE(s)
KEV Date Added
08 June 2026

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1133 External Remote Services Persistence
Adversaries may leverage external-facing remote services to initially access and/or persist within a network.
T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

Vulnerability enables unauthenticated remote bypass of auth in public-facing IKEv1 VPN (Remote Access/Mobile Access), directly facilitating T1133 External Remote Services and T1190 Exploit Public-Facing Application.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

Affected Assets

checkpoint
gaia os
r81.20, r82, r82.10 · r80.40 — r81.20
checkpoint
gaia embedded
r81.10.17, r82.00.10 · r80.20.00 — r81.10.17 · r80.20.00 — r82.00.10

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly enforces authentication decisions for remote VPN sessions, blocking the certificate-validation bypass that allows access without a valid password.

prevent

Requires explicit authorization, encryption, and authentication mechanisms for all remote-access VPN connections, directly addressing the IKEv1 Remote Access flaw.

prevent

Mandates identification and authentication of organizational users before granting system access, mitigating the unauthenticated VPN session establishment.

References