EUVD-2026-35047
GHSA-jqxh-x9f5-wcgw
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
Primary rating from Vendor (checkpoint).
CVSS VectorVendor: checkpoint
Lifecycle Timeline
5DescriptionCVE.org
A logic flow weakness in Remote Access and Mobile Access certificate validation in deprecated IKEv1 key exchange allows an unauthenticated remote attacker to bypass user authentication and establish a remote access VPN connection without a valid user password.
Articles & Coverage 2
AnalysisAI
Authentication bypass in Check Point Quantum Security Gateway and Spark Firewalls allows unauthenticated remote attackers to establish Remote Access and Mobile Access VPN sessions without valid credentials by abusing a logic flaw in deprecated IKEv1 certificate validation. The flaw (CVSS 9.3, CWE-287) was reported by Check Point themselves and publicly available exploit code exists, though EPSS exploitation probability remains very low (0.01%) and the issue is not currently listed in CISA KEV. Affected deployments include multiple Quantum R80.40-R82.10 trains and Spark R80.20.X-R82.00.X firmware.
Technical ContextAI
The vulnerability resides in the IKEv1 (Internet Key Exchange version 1) key-exchange handler used by Check Point's Remote Access VPN and Mobile Access blade on Quantum Security Gateway (cpe:2.3:a:checkpoint:quantum_security_gateway) and Spark Firewalls (cpe:2.3:a:checkpoint:spark_firewalls). IKEv1 is a deprecated VPN negotiation protocol still maintained for backward compatibility; during phase-1 authentication the gateway is supposed to validate a client certificate and bind it to a user password challenge. CWE-287 (Improper Authentication) is realized as a logic-flow weakness where the certificate validation path can be traversed in a state that skips the subsequent password verification, allowing session establishment with only a certificate (or a manipulated handshake) and no valid user secret.
RemediationAI
Patch available per vendor advisory: install the Check Point hotfix referenced in sk185033 (https://support.checkpoint.com/results/sk/sk185033), which for Quantum Security Gateway means upgrading Jumbo Hotfix Accumulator beyond Take 19 on R82.10, Take 103 on R82, and Take 141 on R81.20, and applying the corresponding hotfix on R81.10, R81, and R80.40; Spark Firewalls on R80.20.X, R81.10.X, and R82.00.X must be moved to the fixed firmware build named in the SK. Exact released-version strings beyond the Jumbo Take numbers above are not independently confirmed in the supplied data, so verify the target build in the SK before scheduling. As a compensating control where patching is not immediate, disable IKEv1 on the Remote Access and Mobile Access communities and require IKEv2 only - this breaks legacy clients that cannot negotiate IKEv2, so inventory VPN clients first; alternatively, restrict UDP/500 and UDP/4500 from the internet to a small set of known source IPs via an upstream ACL, accepting that roaming users will lose service from unlisted networks.
More in Checkpoint
View allGNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
Potentially allowing an attacker to read certain information on Check Point Security Gateways once connected to the inte
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
backend/comics/comics-document.c (aka the comic book backend) in GNOME Evince before 3.24.1 allows remote attackers to e
Authentication bypass in the Check Point SmartConsole login process lets an unauthenticated remote attacker mint a valid
Remote code execution in Check Point Quantum Security Gateway and Quantum Security Management stems from a heap-based bu
Remote code execution in Check Point Quantum Security Gateway arises from improper certificate trust validation during V
The huggingface/transformers library is vulnerable to arbitrary code execution through deserialization of untrusted data
PyTorch is a Python package that provides tensor computation. [CVSS 8.8 HIGH]
Check Point ZoneAlarm Extreme Security before 15.8.211.19229 allows local users to escalate privileges. Rated high sever
Remote code execution in PyTorch Lightning through 2.6.5 allows an attacker who can get a victim to load a malicious che
Check Point Endpoint Security Initial Client for Windows before version E81.30 tries to load a DLL placed in any PATH lo
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today