EUVD-2026-35047
GHSA-jqxh-x9f5-wcgw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify internet-facing Check Point VPN on UDP/500
-
DeliveryInitiate IKEv1 Phase-1 handshake
-
ExploitTrigger logic flaw in certificate validation
-
ExecutionBypass password authentication step
-
PersistEstablish Remote Access VPN tunnel
-
ImpactPivot to internal network resources
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication mechanism validation
MITRE ATT&CK
2 techniques across 2 tactics: Defense Evasion, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The gateway must have the Remote Access VPN or Mobile Access blade enabled with the deprecated IKEv1 key exchange permitted (Check Point gateways that have been configured to negotiate IKEv2 only are not exploitable via this path), and UDP/500 plus UDP/4500 must be reachable from the attacker - typically true for any internet-facing VPN portal. No user credentials, no user interaction, and no prior foothold are required (PR:N, UI:N, AC:L). Limiting factors: gateways on the listed Spark R80.20.X/R81.10.X/R82.00.X firmware or Quantum R80.40 through R82.10 trains below the fixed Jumbo Hotfix Take are in scope; deployments using IKEv2-only profiles, or where the Remote Access/Mobile Access blade is not enabled, are not exploitable. |
| Impact | The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N indicates a network-reachable, low-complexity, unauthenticated, no-user-interaction attack with scope change and high confidentiality impact - consistent with full VPN access into the protected network. Publicly available exploit code raises practical risk, yet EPSS sits at 0.01% (1st percentile) and the CVE is not in CISA KEV, suggesting that despite a working POC, broad opportunistic exploitation has not (yet) been observed; this pattern is typical for newly disclosed enterprise VPN flaws before mass scanning begins. The signals are partially conflicting: very high CVSS and POC availability versus very low EPSS and no KEV listing - defenders with internet-exposed Check Point VPN portals should treat this as urgent regardless, because the prerequisites (reachable IKEv1 endpoint) are common and the impact is network entry. |
| Exploit ScenarioDerived | An attacker on the internet sends an IKEv1 Aggressive or Main Mode handshake to the gateway's UDP/500 endpoint, presents a certificate (or a crafted handshake exercising the flawed validation path), and the gateway transitions to an authenticated VPN session without ever validating the user password. With publicly available exploit code, a low-skilled actor can use this to obtain an interactive tunnel and pivot to internal RDP, SMB, or management interfaces. Scope change (S:C) in the CVSS vector reflects exactly this jump from the VPN authentication boundary into the protected enterprise network. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 08, 2026
Authentication bypass in Check Point Quantum Security Gateway and Spark Firewalls allows unauthenticated remote attackers to establish Remote Access and Mobile Access VPN sessions without valid credentials by abusing a logic flaw in deprecated IKEv1 certificate validation. The flaw (CVSS 9.3, CWE-287) was reported by Check Point themselves and publicly available exploit code exists, though EPSS exploitation probability remains very low (0.01%) and the issue is not currently listed in CISA KEV. Affected deployments include multiple Quantum R80.40-R82.10 trains and Spark R80.20.X-R82.00.X firmware.
RemediationAI
Patch available per vendor advisory: install the Check Point hotfix referenced in sk185033 (https://support.checkpoint.com/results/sk/sk185033), which for Quantum Security Gateway means upgrading Jumbo Hotfix Accumulator beyond Take 19 on R82.10, Take 103 on R82, and Take 141 on R81.20, and applying the corresponding hotfix on R81.10, R81, and R80.40; Spark Firewalls on R80.20.X, R81.10.X, and R82.00.X must be moved to the fixed firmware build named in the SK. Exact released-version strings beyond the Jumbo Take numbers above are not independently confirmed in the supplied data, so verify the target build in the SK before scheduling. As a compensating control where patching is not immediate, disable IKEv1 on the Remote Access and Mobile Access communities and require IKEv2 only - this breaks legacy clients that cannot negotiate IKEv2, so inventory VPN clients first; alternatively, restrict UDP/500 and UDP/4500 from the internet to a small set of known source IPs via an upstream ACL, accepting that roaming users will lose service from unlisted networks.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in the IKEv1 (Internet Key Exchange version 1) key-exchange handler used by Check Point's Remote Access VPN and Mobile Access blade on Quantum Security Gateway (cpe:2.3:a:checkpoint:quantum_security_gateway) and Spark Firewalls (cpe:2.3:a:checkpoint:spark_firewalls). IKEv1 is a deprecated VPN negotiation protocol still maintained for backward compatibility; during phase-1 authentication the gateway is supposed to validate a client certificate and bind it to a user password challenge. CWE-287 (Improper Authentication) is realized as a logic-flow weakness where the certificate validation path can be traversed in a state that skips the subsequent password verification, allowing session establishment with only a certificate (or a manipulated handshake) and no valid user secret.
Know when Checkpoint gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
Primary rating from Vendor (checkpoint).
CVSS VectorVendor: checkpoint
Lifecycle Timeline
4DescriptionCVE.org
A logic flow weakness in Remote Access and Mobile Access certificate validation in deprecated IKEv1 key exchange allows an unauthenticated remote attacker to bypass user authentication and establish a remote access VPN connection without a valid user password.
Articles & Coverage 2
Executive ViewAI
Check Point Quantum Security Gateway and Spark Firewalls contain a critical vulnerability allowing unauthenticated remote attackers to bypass VPN authentication and establish remote access sessions without credentials; publicly available exploit code exists. This directly threatens remote workforce security and exposes core network infrastructure to unauthorized access through compromised perimeter controls.
No vendor-released patch identified at time of analysis. Interim mitigations: Disable IKEv1 in favor of IKEv2 where feasible, implement IP-based access controls on VPN gateways, require multi-factor authentication for all VPN users, enhance monitoring of authentication failures and anomalous sessions, and evaluate temporary network segmentation of affected systems pending patch availability.
Threat Intelligence Overview
NVD
CVE.org
CISA KEV
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Checkpoint
View allGNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
Potentially allowing an attacker to read certain information on Check Point Security Gateways once connected to the inte
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
backend/comics/comics-document.c (aka the comic book backend) in GNOME Evince before 3.24.1 allows remote attackers to e
Remote code execution in Check Point Quantum Security Gateway arises from improper certificate trust validation during V
Authentication bypass in the Check Point SmartConsole login process lets an unauthenticated remote attacker mint a valid
Unauthenticated attackers who can reach the file-upload interface of Check Point Management Server can combine directory
An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. Rated med
Remote code execution in Check Point Quantum Security Gateway and Quantum Security Management stems from a heap-based bu
Unauthenticated remote code execution affects Check Point Quantum Security Management, where a stack-based buffer overfl
The huggingface/transformers library is vulnerable to arbitrary code execution through deserialization of untrusted data
Elevated-privilege container restoration in CRI-O 1.34 and later, including downstream Red Hat OpenShift Container Platf
Exploit-DB