CVE-2026-50751

This bug breaks a security check that should verify a user really has permission to connect to your VPN. With the problem, an attacker can set up a remote connection without needing a valid user password. Think of it like a door that’s supposed to require a key, but a mistake in the ID-check lets someone walk in by exploiting how certificates are validated during a specific VPN handshake.

This matters to you if you run or administer Check Point VPN remote access and mobile access using these products: checkpoint Quantum Security Gateway, checkpoint Spark Firewalls, checkpoint gaia os, and checkpoint gaia embedded. Your risk is higher if you have remote/mobile workers connecting over VPN or if these gateways are exposed to the internet, because attackers can attempt to connect directly. The issue is tied to Remote Access and Mobile Access and specifically the deprecated IKEv1 key exchange flow.

This is RED because it is being exploited in the wild and is tied to ransomware activity, meaning real attackers are actively looking for vulnerable systems. The probability of exploitation in the near term is estimated to be high, and public patch guidance is likely to be the main path to safety. You should act immediately rather than waiting for normal maintenance.