What is the CVSS score of CVE-2026-50751?

CVE-2026-50751 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Check Point Quantum Gateway are affected by CVE-2026-50751?

Check Point Quantum Security Gateway and Spark Firewalls contain a critical vulnerability allowing unauthenticated remote attackers to bypass VPN authentication and establish remote access sessions…

Is there a public PoC exploit available for CVE-2026-50751?

Yes, a public proof-of-concept exploit is available for CVE-2026-50751. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-50751?

Within 24 hours: Identify all Quantum (R80.40-R82.10) and Spark (R80.20.X-R82.00.X) appliances and verify affected firmware versions; disable IKEv1 protocol if operationally feasible; begin monitoring VPN access logs for anomalies. Within 7 days: Implement IP-based access restrictions on VPN gateways; enforce multi-factor authentication for all VPN sessions; enable enhanced authentication and session logging. Within 30 days: Monitor Check Point security advisories for patch release; evaluate upgrade to unaffected firmware versions or alternative VPN solutions; assess temporary isolation of affected gateways if operational constraints permit.

Check Point Quantum Gateway CVE-2026-50751

EUVD-2026-35047 CRITICAL

Improper Authentication (CWE-287)

2026-06-08 checkpoint

GHSA-jqxh-x9f5-wcgw

Authentication Bypass Microsoft Quantum Security Gateway Spark Firewalls

9.3

CVSS 3.1 · Vendor: checkpoint

Severity by source

Vendor (checkpoint) PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

ENISA EUVD

CRITICAL

qualitative

Primary rating from Vendor (checkpoint).

CVSS VectorVendor: checkpoint

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Added to CISA KEV

Jun 08, 2026 - 19:31 CISA

Analysis Generated

Jun 08, 2026 - 17:25 vuln.today

CVSS changed

Jun 08, 2026 - 17:22 NVD

9.3 (CRITICAL)

CVE Published

Jun 08, 2026 - 11:07 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 08, 2026 - 11:07 nvd

CRITICAL 9.3

DescriptionCVE.org

A logic flow weakness in Remote Access and Mobile Access certificate validation in deprecated IKEv1 key exchange allows an unauthenticated remote attacker to bypass user authentication and establish a remote access VPN connection without a valid user password.

Articles & Coverage 2

labs.watchtowr.com CVE-2026-50751: Check Point VPN IKEv1 Authentication Bypass Exploited by Ransomware Groups Jun 12, 2026 POC CVE-2026-50751: Check Point Remote Access VPN IKEv1 Certificate Authentication Bypass (CVSS 9.3) Jun 10, 2026

AnalysisAI

Authentication bypass in Check Point Quantum Security Gateway and Spark Firewalls allows unauthenticated remote attackers to establish Remote Access and Mobile Access VPN sessions without valid credentials by abusing a logic flaw in deprecated IKEv1 certificate validation. The flaw (CVSS 9.3, CWE-287) was reported by Check Point themselves and publicly available exploit code exists, though EPSS exploitation probability remains very low (0.01%) and the issue is not currently listed in CISA KEV. Affected deployments include multiple Quantum R80.40-R82.10 trains and Spark R80.20.X-R82.00.X firmware.

Technical ContextAI

The vulnerability resides in the IKEv1 (Internet Key Exchange version 1) key-exchange handler used by Check Point's Remote Access VPN and Mobile Access blade on Quantum Security Gateway (cpe:2.3:a:checkpoint:quantum_security_gateway) and Spark Firewalls (cpe:2.3:a:checkpoint:spark_firewalls). IKEv1 is a deprecated VPN negotiation protocol still maintained for backward compatibility; during phase-1 authentication the gateway is supposed to validate a client certificate and bind it to a user password challenge. CWE-287 (Improper Authentication) is realized as a logic-flow weakness where the certificate validation path can be traversed in a state that skips the subsequent password verification, allowing session establishment with only a certificate (or a manipulated handshake) and no valid user secret.

RemediationAI

Patch available per vendor advisory: install the Check Point hotfix referenced in sk185033 (https://support.checkpoint.com/results/sk/sk185033), which for Quantum Security Gateway means upgrading Jumbo Hotfix Accumulator beyond Take 19 on R82.10, Take 103 on R82, and Take 141 on R81.20, and applying the corresponding hotfix on R81.10, R81, and R80.40; Spark Firewalls on R80.20.X, R81.10.X, and R82.00.X must be moved to the fixed firmware build named in the SK. Exact released-version strings beyond the Jumbo Take numbers above are not independently confirmed in the supplied data, so verify the target build in the SK before scheduling. As a compensating control where patching is not immediate, disable IKEv1 on the Remote Access and Mobile Access communities and require IKEv2 only - this breaks legacy clients that cannot negotiate IKEv2, so inventory VPN clients first; alternatively, restrict UDP/500 and UDP/4500 from the internet to a small set of known source IPs via an upstream ACL, accepting that roaming users will lose service from unlisted networks.