EUVD-2026-35047
GHSA-jqxh-x9f5-wcgw
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
Lifecycle Timeline
5DescriptionCVE.org
A logic flow weakness in Remote Access and Mobile Access certificate validation in deprecated IKEv1 key exchange allows an unauthenticated remote attacker to bypass user authentication and establish a remote access VPN connection without a valid user password.
Articles & Coverage 2
AnalysisAI
Authentication bypass in Check Point Quantum Security Gateway and Spark Firewalls allows unauthenticated remote attackers to establish Remote Access and Mobile Access VPN sessions without valid credentials by abusing a logic flaw in deprecated IKEv1 certificate validation. The flaw (CVSS 9.3, CWE-287) was reported by Check Point themselves and publicly available exploit code exists, though EPSS exploitation probability remains very low (0.01%) and the issue is not currently listed in CISA KEV. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The gateway must have the Remote Access VPN or Mobile Access blade enabled with the deprecated IKEv1 key exchange permitted (Check Point gateways that have been configured to negotiate IKEv2 only are not exploitable via this path), and UDP/500 plus UDP/4500 must be reachable from the attacker - typically true for any internet-facing VPN portal. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N indicates a network-reachable, low-complexity, unauthenticated, no-user-interaction attack with scope change and high confidentiality impact - consistent with full VPN access into the protected network. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker on the internet sends an IKEv1 Aggressive or Main Mode handshake to the gateway's UDP/500 endpoint, presents a certificate (or a crafted handshake exercising the flawed validation path), and the gateway transitions to an authenticated VPN session without ever validating the user password. With publicly available exploit code, a low-skilled actor can use this to obtain an interactive tunnel and pivot to internal RDP, SMB, or management interfaces. … |
| Remediation | Patch available per vendor advisory: install the Check Point hotfix referenced in sk185033 (https://support.checkpoint.com/results/sk/sk185033), which for Quantum Security Gateway means upgrading Jumbo Hotfix Accumulator beyond Take 19 on R82.10, Take 103 on R82, and Take 141 on R81.20, and applying the corresponding hotfix on R81.10, R81, and R80.40; Spark Firewalls on R80.20.X, R81.10.X, and R82.00.X must be moved to the fixed firmware build named in the SK. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all Quantum (R80.40-R82.10) and Spark (R80.20.X-R82.00.X) appliances and verify affected firmware versions; disable IKEv1 protocol if operationally feasible; begin monitoring VPN access logs for anomalies. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today