CVE-2026-50751: Check Point Security Gateway Improper Authentication Vulnerability

This vulnerability affects Check Point Security Gateway and stems from improper authentication in the IKEv1 key exchange process. An unauthenticated remote attacker can bypass user authentication to establish a remote access VPN connection without supplying a valid password. The issue has been observed in ransomware activity, increasing the chance of unauthorized network entry.

How it works

The weakness is tracked as CWE-287, improper authentication. The flaw resides in the IKEv1 key exchange implementation on the gateway.

• An attacker sends IKEv1 messages from a remote system without presenting valid credentials.
• The authentication step fails to enforce the expected password check, allowing the VPN tunnel to complete.
• Once the tunnel is up, the attacker obtains the same network access normally granted to authenticated remote users.

Am I affected? How to find it in your systems

Check Point Security Gateway appliances and virtual instances that terminate remote access VPNs are the primary targets. Inventory all perimeter and branch gateways running this software and note any configurations that enable IKEv1.

• Query asset management or network discovery tools for devices identified as Check Point Security Gateway.
• Review VPN configuration files or management console settings for active IKEv1 policies.
• Examine VPN authentication logs for successful connections that lack corresponding user-password events or that originate from unexpected source addresses.
• Confirm exact affected versions and configurations against the vendor advisory, as public detail is limited.

How to remediate

Apply the vendor update referenced in the official advisory as the primary step. After patching, review and tighten authentication settings for all remote access VPN profiles.

• Disable IKEv1 where IKEv2 or other modern protocols can be used instead.
• Enforce certificate-based or multi-factor authentication on remaining VPN connections.
• Restrict the IP ranges permitted to initiate IKEv1 negotiations to the minimum required set.

If you can't patch immediately

Follow the mitigations listed in the vendor advisory and any applicable CISA BOD 22-01 guidance for cloud-hosted instances. Segment gateway management and VPN termination interfaces so they are reachable only from trusted management networks.

• Monitor VPN logs and network flow data for anomalous connection patterns until patches can be applied.
• Consider temporary disablement of IKEv1 if business requirements allow.
• Apply network-level access controls that limit inbound UDP ports used by IKEv1 to known, authorized endpoints.

If your data may have been exposed

Actively exploited vulnerabilities of this type have led to breaches. Run a free exposure scan of your organization's email domains against known breach data to identify any related account exposure.