CVE-2026-50751

checkpoint Quantum Security Gateway, checkpoint Spark Firewalls

Published 8 Jun 2026 · updated 4 Aug 2026 · Analyzed

9.3 Critical · CVSS 3.1, CISA ADP

Exploited in the wild

CISA added this to its Known Exploited Vulnerabilities catalog on 8 Jun 2026, with a remediation deadline of 11 Jun 2026 for US federal agencies. It has been used in ransomware campaigns.

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Description

A logic flow weakness in Remote Access and Mobile Access certificate validation in deprecated IKEv1 key exchange allows an unauthenticated remote attacker to bypass user authentication and establish a remote access VPN connection without a valid user password.

References

support.checkpoint.com/results/sk/sk185033 · Mitigation, Patch, Vendor Advisory
blog.checkpoint.com/security/check-point-releases-important-hotfix-for-vulnerabilities-in-deprecated-ikev1-vpn-protocol/ · Vendor Advisory
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-50751 · US Government Resource