CVE-2026-50751

A logic error (CWE-287) in the certificate validation process during IKEv1 negotiation causes the user identity verification mechanism to be bypassed. An attacker, without possessing the correct password, is able to conduct an IKEv1 session in such a way that the system incorrectly recognizes authentication as successfully completed. As a result, a remote attacker can establish a full-fledged VPN connection within the Remote Access or Mobile Access functions.

An attacker can gain unauthorized access to an organization's internal network through a VPN tunnel, creating a risk of confidential data disclosure (High Confidentiality) and limited modifications to protected resources (Low Integrity). The vulnerability enables lateral movement within the network.

The hotfix provided by Check Point should be applied immediately in accordance with the recommendations in article sk185033 (https://support.checkpoint.com/results/sk/sk185033). Additionally, it is recommended to disable support for the deprecated IKEv1 protocol wherever it is not absolutely required, and to migrate to IKEv2.

Check Point products supporting Remote Access VPN and Mobile Access functions with deprecated IKEv1 protocol support enabled — specific versions indicated in vendor references (sk185033).

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Check Point Security Gateway contains an improper authentication vulnerability in IKEv1 key exchange that could allow an unauthenticated remote attacker to bypass user authentication and establish a remote access VPN connection without a valid user password.