CVE-2026-50751
Description
Critical CVSS 9.3 authentication bypass in Check Point Security Gateway VPNs. Actively exploited; immediate patching of Gaia OS is required.
CPE
| Product | Version Start | Version End (excl.) | Status |
|---|---|---|---|
| gaia_os | r80.40 | r81.20 | vulnerable |
| gaia_os | r81.20 | r81.20 | vulnerable |
| gaia_os | r81.20 | r81.20 | vulnerable |
| gaia_os | r81.20 | r81.20 | vulnerable |
| gaia_os | r81.20 | r81.20 | vulnerable |
| gaia_os | r81.20 | r81.20 | vulnerable |
| gaia_os | r81.20 | r81.20 | vulnerable |
| gaia_os | r81.20 | r81.20 | vulnerable |
| gaia_os | r81.20 | r81.20 | vulnerable |
| gaia_os | r81.20 | r81.20 | vulnerable |
| gaia_os | r81.20 | r81.20 | vulnerable |
| gaia_os | r81.20 | r81.20 | vulnerable |
| gaia_os | r81.20 | r81.20 | vulnerable |
| gaia_os | r81.20 | r81.20 | vulnerable |
| gaia_os | r81.20 | r81.20 | vulnerable |
| gaia_os | r81.20 | r81.20 | vulnerable |
| gaia_os | r81.20 | r81.20 | vulnerable |
| gaia_os | r81.20 | r81.20 | vulnerable |
| gaia_os | r81.20 | r81.20 | vulnerable |
| gaia_os | r81.20 | r81.20 | vulnerable |
| gaia_os | r81.20 | r81.20 | vulnerable |
| gaia_os | r81.20 | r81.20 | vulnerable |
| gaia_os | r81.20 | r81.20 | vulnerable |
| gaia_os | r81.20 | r81.20 | vulnerable |
| gaia_os | r81.20 | r81.20 | vulnerable |
| gaia_os | r81.20 | r81.20 | vulnerable |
| gaia_os | r81.20 | r81.20 | vulnerable |
| gaia_os | r81.20 | r81.20 | vulnerable |
| gaia_os | r81.20 | r81.20 | vulnerable |
| gaia_os | r81.20 | r81.20 | vulnerable |
| gaia_os | r81.20 | r81.20 | vulnerable |
| gaia_os | r81.20 | r81.20 | vulnerable |
| gaia_os | r81.20 | r81.20 | vulnerable |
| gaia_os | r81.20 | r81.20 | vulnerable |
| gaia_os | r81.20 | r81.20 | vulnerable |
| gaia_os | r81.20 | r81.20 | vulnerable |
| gaia_os | r81.20 | r81.20 | vulnerable |
| gaia_os | r82 | r82 | vulnerable |
| gaia_os | r82 | r82 | vulnerable |
| gaia_os | r82 | r82 | vulnerable |
| gaia_os | r82 | r82 | vulnerable |
| gaia_os | r82 | r82 | vulnerable |
| gaia_os | r82 | r82 | vulnerable |
| gaia_os | r82 | r82 | vulnerable |
| gaia_os | r82 | r82 | vulnerable |
| gaia_os | r82 | r82 | vulnerable |
| gaia_os | r82 | r82 | vulnerable |
| gaia_os | r82 | r82 | vulnerable |
| gaia_os | r82 | r82 | vulnerable |
| gaia_os | r82 | r82 | vulnerable |
| gaia_os | r82 | r82 | vulnerable |
| gaia_os | r82 | r82 | vulnerable |
| gaia_os | r82 | r82 | vulnerable |
| gaia_os | r82 | r82 | vulnerable |
| gaia_os | r82 | r82 | vulnerable |
| gaia_os | r82.10 | r82.10 | vulnerable |
| gaia_os | r82.10 | r82.10 | vulnerable |
| gaia_os | r82.10 | r82.10 | vulnerable |
| gaia_embedded | r80.20.00 | r81.10.17 | vulnerable |
| gaia_embedded | r81.10.17 | r81.10.17 | vulnerable |
| gaia_embedded | r81.10.17 | r81.10.17 | vulnerable |
| gaia_embedded | r81.10.17 | r81.10.17 | vulnerable |
| gaia_embedded | r81.10.17 | r81.10.17 | vulnerable |
| gaia_embedded | r81.10.17 | r81.10.17 | vulnerable |
| gaia_embedded | r81.10.17 | r81.10.17 | vulnerable |
| quantum_spark_1530 | - | - | unaffected |
| quantum_spark_1550 | - | - | unaffected |
| quantum_spark_1570 | - | - | unaffected |
| quantum_spark_1570r | - | - | unaffected |
| quantum_spark_1590 | - | - | unaffected |
| quantum_spark_1595r | - | - | unaffected |
| quantum_spark_1600 | - | - | unaffected |
| quantum_spark_1800 | - | - | unaffected |
| quantum_spark_1900 | - | - | unaffected |
| quantum_spark_2000 | - | - | unaffected |
| gaia_embedded | r80.20.00 | r82.00.10 | vulnerable |
| gaia_embedded | r82.00.10 | r82.00.10 | vulnerable |
| gaia_embedded | r82.00.10 | r82.00.10 | vulnerable |
| gaia_embedded | r82.00.10 | r82.00.10 | vulnerable |
| gaia_embedded | r82.00.10 | r82.00.10 | vulnerable |
| gaia_embedded | r82.00.10 | r82.00.10 | vulnerable |
| gaia_embedded | r82.00.10 | r82.00.10 | vulnerable |
| gaia_embedded | r82.00.10 | r82.00.10 | vulnerable |
| quantum_spark_1535 | - | - | unaffected |
| quantum_spark_1555 | - | - | unaffected |
| quantum_spark_1575 | - | - | unaffected |
| quantum_spark_1575r | - | - | unaffected |
| quantum_spark_2530 | - | - | unaffected |
| quantum_spark_2550 | - | - | unaffected |
| quantum_spark_2560 | - | - | unaffected |
| quantum_spark_2570 | - | - | unaffected |
| quantum_spark_2580 | - | - | unaffected |
| quantum_spark_2590 | - | - | unaffected |
Related weakness (CWE)
Remediation plan
Apply official patches
Immediately install the recommended hotfixes provided by Check Point for your specific gateway version as outlined in security advisory sk185033.
Update affected systems
Ensure Gaia OS systems (R80.40 through R81.20, R82, and R82.10) and Gaia Embedded systems (R80.20.00 through R82.00.10) are updated to the latest vendor-supplied versions.
Restrict access
Disable the deprecated IKEv1 key exchange protocol and migrate all Remote Access VPN clients to IKEv2 to eliminate the vulnerable attack surface.
Monitor for exploitation
Audit VPN login logs for successful sessions that bypass standard authentication flows or originate from suspicious, unrecognized IP addresses.
Detection Guidance
Monitor Check Point gateway logs for successful VPN connections established via IKEv1 that lack associated password authentication events. Use network security monitoring to identify unusual traffic on UDP ports 500 and 4500. Specifically, look for IKEv1 Phase 1 negotiations that bypass certificate validation steps. Organizations should also check for the presence of unauthorized VPN tunnels and review Check Point's official blog for specific indicators of compromise (IOCs) related to this active campaign.