CVE-2026-50751
Published 2026-06-08 · Updated 2026-08-04 · Source cve@checkpoint.com
Summary
CVE-2026-50751 is a critical-severity (CVSS 9.3) vulnerability in Check Point Security Gateway. CISA added it to the Known Exploited Vulnerabilities catalog on June 8, 2026, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by June 11, 2026. CISA also lists it as known to be used in ransomware campaigns, so it should be prioritised accordingly. Check Point has 5 vulnerabilities in the KEV catalog, 2 of them linked to ransomware.
All 5 known-exploited Check Point vulnerabilities →Description
A logic flow weakness in Remote Access and Mobile Access certificate validation in deprecated IKEv1 key exchange allows an unauthenticated remote attacker to bypass user authentication and establish a remote access VPN connection without a valid user password.
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
CISA Known-Exploited Vulnerability
Product: Check Point — Security Gateway
Name: Check Point Security Gateway Improper Authentication Vulnerability
Date added: 2026-06-08 · Due: 2026-06-11
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.