CVE-2026-50751criticalunder attackransomwareCWE-287

CVE-2026-50751: critical vulnerability in checkpoint Quantum Security Gateway

User Authentication Bypass in VPN Remote Access and Mobile Access

Published · Updated

Follow this CVE+ Monitor Quantum Security Gateway+ Monitor Security Gateway

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA, has an official Brazilian government alert, has a working public exploit and 1 threat group(s) use it.

ssvc Actcvss 9.3epss 85%
from disclosure to weaponsame day
Published on NVDJun 8
1st PoCJun 8
CISA KEVJun 8
victimsAug 27
Official alert in Brazil

Brazil's federal government published an alert, recommendation or bulletin that cites this vulnerability.

  • CTIR Gov · ALERTA 47/2026 · 09 Jun 2026Vulnerabilidade crítica no Security Gateway da Check Pointread on gov.br ↗
  • CISC Gov.br · 09 Jun 2026Bypass de Autenticação no Check Point Remote Access VPNread on gov.br ↗
Source: CTIR Gov (GSI) and CISC Gov.br, under the CC BY-ND 3.0 license.
Appeared in 1 incident(s) we investigated
Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF)
Who exploits it — 1

Groups known to exploit this vulnerability (MITRE ATT&CK attribution).

Ransomwareqilin Vexday
Action required by CISAfederal deadline: 2026-06-11

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

In short

A flaw in VPN certificate validation lets attackers connect to corporate networks without needing a valid password. This is critical because it gives unauthorized people direct access to internal systems and sensitive data.

Technical detail

CWE-287 authentication bypass in IKEv1 key exchange certificate validation permits unauthenticated remote attackers to establish VPN sessions without credential verification. The vulnerability stems from improper logic flow in certificate validation mechanisms, enabling complete circumvention of user authentication controls in remote and mobile access deployments.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

A logic flow weakness in Remote Access and Mobile Access certificate validation in deprecated IKEv1 key exchange allows an unauthenticated remote attacker to bypass user authentication and establish a remote access VPN connection without a valid user password.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
Affected products
checkpoint · Quantum Security Gatewaycheckpoint · Spark Firewalls
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — checkpoint Quantum Security Gateway

In the same product, most dangerous first.

CVE-2026-85102CRITICALImproper Certificate Validation in Quantum Security GatewayEPSS 54.1%KEVCVE-2026-50752HIGHCertificate Validation Bypass in VPN Site-to-Site Connections Using IKEv1EPSS 4.7%CVE-2026-48133HIGHIdentity Awareness Captive Portal - Unauthenticated Local File InclusionEPSS 4.5%CVE-2026-85103CRITICALHeap-based Buffer Overflow in VPN Certificate ASN.1 DecodingEPSS 4.3%CVE-2026-48134MEDIUMSQL injection issue in UserCheck Portal when DLP Software Blade is activeEPSS 4.0%CVE-2026-48131HIGHVPND IKE Fragment Reassembly - Heap Out-of-Bounds Write via Sequence Number ZeroEPSS 2.7%