CVE-2026-50751

criticalpriority · act · 90OT risk · criticalKEV · exploitedEPSS 0.853 · 100 %ileexploit · PoCDEEUNLRUUS

grimoire priorityP0 · Act now

Exploitable?

Yes · in the wild

CISA KEV · 8 exploits · PoC

Likely / severe?

85.3% (100th) EPSS

CVSS 9.3 · critical

Is it mine?

39 products

Check your exposure

Who says so?

5 sources

cnnvd · enisa_euvd · fstec_bdu · cert_bund

added 2026-06-08remediate by 2026-06-11

required action Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

EPSS · scored 2026-10-27

Check Point Security Gateway Improper Authentication Vulnerability

A logic flow weakness in Remote Access and Mobile Access certificate validation in deprecated IKEv1 key exchange allows an unauthenticated remote attacker to bypass user authentication and establish a remote access VPN connection without a valid user password.

cvss

Technical severity, 0–10. One row per scoring source.

9.3

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.19.3criticalAV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:Nsecondary · FSTEC (BDU) RU

v3.19.3criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:Nsecondary · ENISA EU

v3.19.3criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:Nsecondaryexploitability 3.9 · impact 4.7

v3.19.3criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N/E:Hsecondary · CVSS-BT (t0sche)

v3.19.3criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:Nsecondary · NCSC-NL NL

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: active · Automatable: yes · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-287USCWE-287US

exploits (8)

Public proof-of-concept and weaponised exploit code.

affected products (39)

Products and version ranges known to be affected.

Check Point Mobile Accessall versionscert_bundDEcpe:/a:checkpoint:mobile_access:-
Check Point Remote Access VPNall versionscert_bundDEcpe:/a:checkpoint:remote_access_vpn:-
Check Point Spark Firewallall versionscert_bundDEcpe:/a:checkpoint:spark_firewall:-
checkpoint Quantum Security Gateway≤ R81.10, R81, and R80.40enisa_euvdEU
checkpoint Quantum Security Gateway≤ R81.20 with Jumbo Hotfix Take 141 or belowenisa_euvdEU
checkpoint Quantum Security Gateway≤ R82 with Jumbo Hotfix Take 103 or belowenisa_euvdEU
checkpoint Quantum Security Gateway≤ R82.10 with Jumbo Hotfix Take 19 or belowenisa_euvdEU
checkpoint Spark Firewalls≤ R80.20.X, R81.10.X, and R82.00.Xenisa_euvdEU
Check Point Software Technologies Ltd. Check Point Mobile Access/SSL VPN≤ R80.20fstec_bduRU
Check Point Software Technologies Ltd. Check Point Mobile Access/SSL VPN≤ R82.10fstec_bduRU
Check Point Software Technologies Ltd. Check Point Mobile Access/SSL VPN≤ R82fstec_bduRU
Check Point Software Technologies Ltd. Check Point Mobile Access/SSL VPN≤ R81.20fstec_bduRU
Check Point Software Technologies Ltd. Check Point Mobile Access/SSL VPN≤ R81.10fstec_bduRU
Check Point Software Technologies Ltd. Check Point Mobile Access/SSL VPN≤ R81fstec_bduRU
Check Point Software Technologies Ltd. Check Point Mobile Access/SSL VPN≤ R80.40fstec_bduRU
Check Point Software Technologies Ltd. Check Point Remote Access VPN≤ R80.20fstec_bduRU
Check Point Software Technologies Ltd. Check Point Remote Access VPN≤ R82.10fstec_bduRU
Check Point Software Technologies Ltd. Check Point Remote Access VPN≤ R82fstec_bduRU
Check Point Software Technologies Ltd. Check Point Remote Access VPN≤ R81.20fstec_bduRU
Check Point Software Technologies Ltd. Check Point Remote Access VPN≤ R81.10fstec_bduRU

showing 20 of 39

advisories (2)

Vendor and ecosystem advisories describing this.

NCSC-2026-0179Kwetsbaarheden verholpen in Check Point Remote and Mobile Access VPN-productenNL2026-06-08csaf · ncsc_nlNL
Check Point heeft kwetsbaarheden verholpen in Remote and Mobile Access VPN-producten, specifiek voor implementaties die gebruikmaken van het IKEv1 key exchange protocol.
WID-SEC-W-2026-1818Check Point Remote Access VPN und Mobile Access: Mehrere Schwachstellen ermöglichen Umgehen von SicherheitsvorkehrungenDeutsch2026-06-08csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Check Point Remote Access VPN und Check Point Mobile Access ausnutzen, um Sicherheitsvorkehrungen zu umgehen.

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cert_bund ncsc_nl NVD CVE.org MITRE

published 2026-06-08modified 2026-08-04

references (7)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan