CVE-2026-50751Active Exploitation(checkpoint / gaia_embedded)

CRITICALCVSS 9.3 · CRITICALCISA KEV

Exploitation observed; activity peaked at 54 mentions and remains active

Immediate actions

Patch checkpoint gaia_embedded systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

A logic flow weakness in Remote Access and Mobile Access certificate validation in deprecated IKEv1 key exchange allows an unauthenticated remote attacker to bypass user authentication and establish a remote access VPN connection without a valid user password.

checkpoint CVEs Back to dashboard

9.5/ 10 priority

Sources & remediation

Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2026-06-11. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Patch / fix

https://support.checkpoint.com/results/sk/sk185033

Vendor / third-party advisories

https://blog.checkpoint.com/security/check-point-releases-important-hotfix-for-vulnerabilities-in-deprecated-ikev1-vpn-protocol/

Other references

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-50751

Weakness type (CWE)

CWE-287

Priority

CRITICAL

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

DECLINING

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

gaia_embedded
gaia_os
quantum_spark_1530
quantum_spark_1535

Threat summary

Active exploitation appears in 198 classified signals
Public PoC and exploit tooling are both present
Patch or workaround signal is available
287 mentions across 49 observed days

What's happening

Active exploitation reported across 198 signals
Exploit tool or code specified in 12 signals
PoC mentioned or linked in 29 signals
Patch or workaround mentioned in 118 signals
Technical details provided in 219 signals
Disclosure: 35 classified signals
Peaked 47d ago at 54 mentions (2026-06-09); latest day: 2
287 total mentions across 49 days

Affected systems

Vendors

checkpoint

Products

gaia_embeddedgaia_osquantum_spark_1530quantum_spark_1535quantum_spark_1550quantum_spark_1555quantum_spark_1570quantum_spark_1570rquantum_spark_1575quantum_spark_1575r

6 versions affected across 22 products

Deep dive

Activity timeline287 mentions / 49d

Signal classification6 categories

Active Exploitation

18163.5%

Disclosure

3512.3%

Patch

3411.9%

General

176.0%

PoC

103.5%

Exploit

82.8%

Referenced assets177 URLs

By indicator

Classification over time

Date	Total	Labels

2026-06-08	45	Active Exploitation35Disclosure3General5Patch2
2026-06-09	54	Active Exploitation43Disclosure3Patch8
2026-06-10	23	Active Exploitation13Disclosure4General3Patch3
2026-06-11	12	Active Exploitation7Disclosure2Patch3
2026-06-12	20	Active Exploitation9Exploit2General2Patch1PoC6
2026-06-13	5	Active Exploitation1Disclosure2Exploit1Patch1
2026-06-14	6	Active Exploitation4PoC2
2026-06-15	9	Active Exploitation5Disclosure1Exploit1Patch2
2026-06-16	12	Active Exploitation8Disclosure2Patch2
2026-06-17	15	Active Exploitation10Disclosure2General2PoC1
2026-06-18	8	Active Exploitation5Disclosure3
2026-06-19	1	Patch1
2026-06-20	1	Exploit1
2026-06-23	3	Active Exploitation2Patch1
2026-06-24	3	Active Exploitation3
2026-06-25	3	Active Exploitation2Patch1
2026-06-26	2	Active Exploitation1Patch1
2026-06-27	1	Active Exploitation1
2026-06-28	1	Disclosure1
2026-06-29	4	Active Exploitation1Disclosure1Patch2
2026-06-30	2	Active Exploitation2
2026-07-01	1	Active Exploitation1
2026-07-02	1	Active Exploitation1
2026-07-03	1	Active Exploitation1
2026-07-05	7	Active Exploitation5Disclosure2
2026-07-06	6	Active Exploitation5Disclosure1
2026-07-08	1	General1
2026-07-09	2	Active Exploitation1Patch1
2026-07-10	2	Active Exploitation1Patch1
2026-07-11	3	Disclosure1General1Patch1
2026-07-12	2	Active Exploitation1Patch1
2026-07-13	5	Disclosure1Exploit3General1
2026-07-17	3	Disclosure1General1Patch1
2026-07-18	1	Disclosure1
2026-07-19	1	Active Exploitation1
2026-07-20	1	PoC1
2026-07-22	1	General1
2026-07-23	4	Active Exploitation4
2026-07-24	1	Active Exploitation1
2026-07-29	1	Active Exploitation1
2026-08-01	1	Patch1
2026-08-05	1	Active Exploitation1
2026-08-06	2	Active Exploitation2
2026-08-07	1	Active Exploitation1
2026-08-11	3	Active Exploitation2Disclosure1
2026-08-12	1	Disclosure1
2026-09-21	1	Disclosure1
2026-10-02	1	Disclosure1

Full discourse20 posts

The Hacker News@TheHackersNews137d
Active Exploitation
🛑 Hackers can get into some Check Point VPNs without knowing the password. And it’s already being exploited. The bug is CVE-2026-50751 and affects IKEv1 Remote Access/Mobile Access setups. Check if your gateways are exposed. Read: https://thehackernews.com/2026/06/critical-check-point-vpn-flaw-exploited.html
Post summary
CVE‑2026‑50751 is presently being exploited against Check Point VPN gateways; administrators should immediately verify gateway exposure.
55311492714.1K
2.0M followersView on X
watchTowr@watchtowrcyber133d
General
Happy Friday! We're back with our analysis of Check Point's friendly CVE-2026-50751, an Authentication Bypass in their.. security-boundary-enforced-by-authentication SSL VPN products... Enjoy! https://labs.watchtowr.com/marking-your-own-homework-check-point-remote-access-vpn-ikev1-authentication-bypass-cve-2026-50751/
Post summary
The post announces an analysis of Check Point's CVE‑2026‑50751, describing it as an authentication bypass in SSL VPN, but provides no PoC, exploit details, active exploitation evidence, patch information, or debunking claims.
23941213530.4K
12.3K followersView on X
Cyber Security News@The_Cyber_News137d
Active Exploitation
🚨 Check Point VPN 0-day Vulnerability Exploited in the Wild to Deploy Ransomware Source: https://cybersecuritynews.com/check-point-vpn-0-day-vulnerability/ Check Point Research has uncovered active exploitation of CVE-2026-50751, a critical authentication bypass vulnerability (CVSS 9.3) in Check Point Remote Access VPN and Mobile Access deployments, with confirmed post-compromise activity linked to the Qilin ransomware gang. CVE-2026-50751 targets deployments configured to use the deprecated IKEv1 key exchange protocol. By exploiting a logic flaw in certificate validation, an unauthenticated remote attacker can establish a VPN session without a valid user password, effectively bypassing all authentication requirements. #cybersecuritynews
Post summary
Check Point Research reports that CVE‑2026‑50751, a critical authentication bypass flaw, is actively exploited in the wild, with ransomware activity confirmed.
129084174.7K
69.7K followersView on X
Rapid7@rapid7137d
Disclosure
🚨 On 6/8/26, #CheckPoint published an advisory for a critical vuln. affecting its Remote Access VPN, Mobile Access & Spark Firewall products. CVE-2026-50751 allows an unauth. attacker to establish a VPN session without providing valid credentials. More: https://r-7.co/4fyoJJc https://t.co/wWQ9jtmnTe
Post summary
CheckPoint released an advisory on June 8 2026 for CVE‑2026‑50751, a critical authentication bypass that lets unauthenticated attackers open VPN sessions in its Remote Access VPN, Mobile Access, and Spark Firewall products. The notice highlights the vulnerability but does not provide a patch or exploit code.
315049199.1K
124.7K followersView on X
Defused@DefusedCyber132d
Active Exploitation
🚨 CVE-2026-50751 (Check Point Remote Access VPN IKEv1 auth bypass) is now under active exploitation We're seeing in-the-wild attempts hitting our decoys, attempting to forge VPN sessions with no valid credentials Track Check Point exploitation live https://console.defusedcyber.com/signup https://t.co/MRp2nHcnJi
Post summary
The tweet announces that CVE‑2026‑50751 is actively being exploited in the wild to bypass authentication on Check Point Remote Access VPN IKEv1, with attackers forging VPN sessions without valid credentials.
011138126.2K
7.5K followersView on X
YogSotho@YogSoth0125d
Exploit
🚨 # CVE-2026-50751 Exploit Kit 💡 **exploit kit for CVE-2026-50751** — ✅ Check Point Remote Access VPN / ✅ Mobile Access / ✅ Spark Firewall IKEv1 authentication bypass 🌐 ## Overview This kit implements the full attack chain discovered by @watchtowrcyber Labs: 1. **Vulnerability**: Logic flaw in IKEv1 certificate validation within the `iked` daemon (not `vpnd`) 2. **Root cause**: The `VPNExtFeatures` Vendor ID payload (magic `3cf187b2474029ea46ac7fd0eaf289f5`) with capability bits allows the client to control authentication flags 3. **Exploit**: Setting bit `0x4` in the capability dword causes `verify_peer_auth` to skip `verifyMessagePhase1` — the certificate signature and trust chain are never validated 4. **Impact**: Authenticate as any provisioned Remote Access user with a self-signed certificate and random signature bytes #exploit #security #0days #hacking #CVE #CVSS #Checkpoint #VPN #Firewall #RCE
Post summary
The post announces an exploit kit for CVE-2026-50751, outlining the full attack chain and technical details of the IKEv1 certificate validation flaw, but does not mention active exploitation or available mitigations.
38029202.2K
1.8K followersView on X
Horizon3.ai@Horizon3ai129d
Active Exploitation
🚨 We reversed an actively exploited VPN authentication bypass in Check Point Security Gateways. Rapid Response test now available for CVE-2026-50751. https://t.co/DeyNFBXLBn
Post summary
The CVE-2026-50751 Check Point VPN authentication bypass is actively exploited in the wild, with a Rapid Response test now available.
41212982.2K
2.9K followersView on X
CISA Cyber@CISACyber137d
General
🛡️ We added BerriAI LiteLLM vulnerability CVE-2026-42271 & Check Point Security Gateway vulnerability CVE-2026-50751 to our KEV Catalog. Visit https://go.dhs.gov/Z3Q & apply mitigations to protect your org from cyberattacks. https://t.co/B3eSaFU0rU
Post summary
The tweet is a general notification adding two CVEs to a DHS KEV catalog, referencing mitigation via a DHS link but providing no technical details, PoC, exploit code, or active exploitation evidence.
11712744.9K
300.6K followersView on X
FOFA@fofabot135d
Active Exploitation
⚠️⚠️ CVE-2026-50751 (CVSS 9.3): Deprecated IKEv1 Remote/Mobile Access certificate validation flaw may let unauthenticated attackers bypass VPN authentication (active exploitation reported). 🔗FOFA Link: https://en.fofa.info/result?qbase64=YXBwPSJDaGVja19Qb2ludC1TU0wtTmV0d29yay1FeHRlbmRlciI= 🎯34.8K+ Results are found on http://en.fofa.info in the past year. FOFA Query: app="Check_Point-SSL-Network-Extender" 🔖Refer: https://support.checkpoint.com/results/sk/sk185033 #OSINT #FOFA #CyberSecurity #Vulnerability
Post summary
CVE‑2026‑50751, a high‑severity IKEv1 certificate validation flaw, is being actively exploited—researchers see thousands of affected URLs on FOFA, and Check Point has issued a patch via its advisory.
01303062.6K
14.5K followersView on X
dbugs@ptdbugs128d
Active Exploitation
🔒 Analysis of CVE-2026-50751: authentication bypass in Check Point VPN PT ID: PT-2026-47276 The research describes a critical vulnerability, CVE-2026-50751 -> (https://dbugs.ptsecurity.com/vulnerability/CVE-2026-50751), in Check Point Remote Access VPN and Mobile Access products, related to the use of the legacy IKEv1 protocol. The vulnerability is caused by a logical flaw in the certificate validation process. As a result, a remote unauthenticated attacker can establish a VPN session without valid credentials, effectively bypassing the authentication mechanism. Exploitation of this vulnerability allows an attacker to gain network access inside the organization's perimeter via the VPN gateway, which is typically an entry point into the corporate infrastructure. The vulnerability is actively exploited in real-world attacks, including by ransomware operators (e.g., Qilin), making it critically dangerous and requiring immediate patching and discontinuation of IKEv1 usage. 📎 Article: https://labs.watchtowr.com/marking-your-own-homework-check-point-remote-access-vpn-ikev1-authentication-bypass-cve-2026-50751/ #dbugs_attacks
Post summary
CVE‑2026‑50751 is an authentication bypass flaw in Check Point VPN that is already being exploited by ransomware operators in the wild, necessitating prompt patching and disabling of IKEv1.
09126121.7K
3.0K followersView on X
IPA （ICATalerts）@ICATalerts135d
Patch
Check Point Software Technologies製品の脆弱性対策について(CVE-2026-50751) https://www.ipa.go.jp/security/security-alert/2026/alert20260610.html
Post summary
The IPA security alert introduces CVE‑2026‑50751 for Check Point Software Technologies products and outlines mitigation steps or patches to address the vulnerability.
0391414.2K
35.7K followersView on X
nekono_nanomotoni@nekono_naha136d
Active Exploitation
CVE-2026-50751 is an actively exploited Check Point VPN issue involving IKEv1 exposure. In my UDP/500/4500 scan of 166,790 Check Point-like Internet-facing IPv4 hosts, 119,414 (71.6%) still had deprecated IKEv1 enabled. This is more widespread than expected. https://t.co/VZotaE4RfA
Post summary
CVE‑2026‑50751 is being actively exploited against Check Point VPNs; a survey revealed that 71.6% of remote hosts still support the deprecated IKEv1 protocol, underscoring the widespread nature of the flaw.
0412986.8K
6.2K followersView on X
Sekurak@Sekurak136d
Active Exploitation
Uwaga na krytyczną podatność w urządzeniach VPN od Checkpoint. ❌ Tym razem problem występuje w protokole IPsec, czy dokładniej w IKEv1 ❌ Podatność jest aktywnie wykorzystywana i umożliwia zalogowanie się do VPNa bez posiadania hasła ❌ CVE-2026-50751, CVSS 9.3/10: "User authentication bypass on VPN Remote Access and Mobile Access in deprecated IKEv1 key exchange." ✅ Wyłącz IKEv1, pozostaw IKEv2 ✅ Zaktualizuj swoje urządzenia
Post summary
The post warns that CVE‑2026‑50751, a critical user authentication bypass in IKEv1, is actively exploited (CVSS 9.3/10) and advises disabling IKEv1 or updating devices to mitigate the risk.
1303145.0K
44.1K followersView on X
Mr. OS@ksg93rd128d
PoC
#NetSec #Red_Team_Tactics 1⃣. Windows fileless latteral movement technique https://github.com/synacktiv/DCOMIllusionist 2⃣. Check Point Remote Access VPN IKEv1 Authentication Bypass (CVE-2026-50751) https://labs.watchtowr.com/marking-your-own-homework-check-point-remote-access-vpn-ikev1-authentication-bypass-cve-2026-50751 3⃣. A 27-Year-Old Authentication Bypass in OpenBSD's PPP Stack https://blog.argus-systems.ai/blog/openbsd-pap-27-year-auth-bypass.html 4⃣. Using WinGet to proxy execution and evade detection https://ipurple.team/2026/06/09/winget 5. Triaging alerts on the go https://cyberpocket.org/
Post summary
The post details CVE-2026-50751 with a working PoC and exploit code, but there is no evidence of active exploitation or a patch.
06015151.2K
3.4K followersView on X
Daily CyberSecurity@the_yellow_fall137d
Active Exploitation
Security teams warn of an active Check Point VPN exploit. This critical CVE-2026-50751 zero-day allows complete authentication bypass. Fix it now. #Cybersecurity #Infosec #CheckPoint #Ransomware #VPN #ZeroDay #PatchNow https://securityonline.info/check-point-vpn-exploit-alert/ https://t.co/klFXP0sFfj
Post summary
The post announces that CVE‑2026‑50751, a zero‑day authentication‑bypass flaw in Check Point VPN, is actively exploited in the wild, though it offers no PoC or patch details.
2712021.4K
12.6K followersView on X
通信の猫@ID=AO_VTuber@ID_JAPAN_AO136d
Patch
ふぁ？！？！マジかこれ？！セキュリティアドバイザリ – 対応が必要 – Check Point VPN認証バイパスの悪用（CVE-2026-50751） https://blog.checkpoint.com/security/check-point-releases-important-hotfix-for-vulnerabilities-in-deprecated-ikev1-vpn-protocol/
Post summary
Check Point issued a hotfix for CVE‑2026‑50751, a VPN authentication bypass in the deprecated IKEv1 protocol, providing a direct patch to mitigate the vulnerability.
1502051.7K
7.7K followersView on X
Defused@DefusedCyber137d
General
🍯 We have recently added multiple new honeypot streams for vendors like Checkpoint, Cisco and Drupal! Track the latest exploit activity against vulnerabilities like CVE-2026-50751 👉 https://console.defusedcyber.com/signup https://t.co/a38Eqjpy4A
Post summary
The tweet promotes a honeypot tracking service for CVE-2026-50751, offering a portal for monitoring but providing no exploit, patch, or technical details.
0422214.1K
7.5K followersView on X
yousukezan@yousukezan21d
Disclosure
Yamahaのルータは最近脆弱性の公開はないですがVPNと無線LANアクセスポイントの脆弱性がありますね UTM UTX200 / UTX100 のVPN（2026年、CVE-2026-50751 / 50752、CVE-2026-85102 / 85103）認証回避による不正VPN接続、サイト間VPNの中間者攻撃、任意プログラム実行の可能性。ルーターおよびファイアウォールは影響を受けない。 https://www.rtpro.yamaha.co.jp/RT/FAQ/Security/CVE-2026-50751.html https://www.rtpro.yamaha.co.jp/RT/FAQ/Security/CVE-2026-85102.html 無線LANアクセスポイント WLX（2024-01-23、JVNVU#99896362、CVE-2024-22366）有効化できるデバッグ機能。ログイン後の特定操作で任意OSコマンドや設定変更の可能性。WLX202 / 212 / 222 / 313 / 413。ルーター本体は非該当。 https://jvn.jp/vu/JVNVU99896362/ https://www.rtpro.yamaha.co.jp/RT/FAQ/Security/JVNVU99896362.html
Post summary
The text discloses multiple Yamaha CVE-2026/2024 vulnerabilities detailing authentication bypass, MitM, and arbitrary code execution risks, but provides no proof-of-concept, exploit tools, active exploitation reports, or named patches/remediation, classifying it as a disclosure of technical details without active exploitation or fix guidance.
0411744.2K
16.5K followersView on X
Nicolas Krassas@Dinosn133d
PoC
Check Point Remote Access VPN IKEv1 certificate-authentication bypass https://github.com/watchtowrlabs/watchTowr-vs-Check-Point-CVE-2026-50751
Post summary
A GitHub repository provides a Proof of Concept for the Check Point Remote Access VPN IKEv1 certificate-authentication bypass (CVE-2026-50751).
1701441.6K
159.0K followersView on X
Dark Web Informer@DarkWebInformer136d
Disclosure
‼️ CISA has added two vulnerabilities to the KEV Catalog https://darkwebinformer.com/cisa-kev-catalog/ CVE-2026-50751: Check Point Security Gateway contains an improper authentication vulnerability in IKEv1 key exchange that could allow an unauthenticated remote attacker to bypass user authentication and establish a remote access VPN connection without a valid user password. CVE-2026-42271: BerriAI LiteLLM contains a command injection vulnerability that could allow any authenticated user, including holders of low-privilege internal-user keys, to run arbitrary commands on the host.
Post summary
The announcement lists two new CVEs added to the CISA KEV catalog, describing an improper authentication flaw in Check Point Security Gateway’s IKEv1 and a command injection in BerriAI LiteLLM, with no mention of PoCs, active exploitation, or patches.
1201764.6K
224.2K followersView on X

CPE platform detail92 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

92 of 92 entries

Part	Vendor	Product	Version	Target SW	Target HW
OS	checkpoint	gaia_embedded	-	-	-
OS	checkpoint	gaia_embedded	r81.10.17	-	-
OS	checkpoint	gaia_embedded	r81.10.17	-	-
OS	checkpoint	gaia_embedded	r81.10.17	-	-
OS	checkpoint	gaia_embedded	r81.10.17	-	-
OS	checkpoint	gaia_embedded	r81.10.17	-	-
OS	checkpoint	gaia_embedded	r81.10.17	-	-
OS	checkpoint	gaia_embedded	r82.00.10	-	-
OS	checkpoint	gaia_embedded	r82.00.10	-	-
OS	checkpoint	gaia_embedded	r82.00.10	-	-
OS	checkpoint	gaia_embedded	r82.00.10	-	-
OS	checkpoint	gaia_embedded	r82.00.10	-	-
OS	checkpoint	gaia_embedded	r82.00.10	-	-
OS	checkpoint	gaia_embedded	r82.00.10	-	-
OS	checkpoint	gaia_os	-	-	-
OS	checkpoint	gaia_os	r81.20	-	-
OS	checkpoint	gaia_os	r81.20	-	-
OS	checkpoint	gaia_os	r81.20	-	-
OS	checkpoint	gaia_os	r81.20	-	-
OS	checkpoint	gaia_os	r81.20	-	-
OS	checkpoint	gaia_os	r81.20	-	-
OS	checkpoint	gaia_os	r81.20	-	-
OS	checkpoint	gaia_os	r81.20	-	-
OS	checkpoint	gaia_os	r81.20	-	-
OS	checkpoint	gaia_os	r81.20	-	-
OS	checkpoint	gaia_os	r81.20	-	-
OS	checkpoint	gaia_os	r81.20	-	-
OS	checkpoint	gaia_os	r81.20	-	-
OS	checkpoint	gaia_os	r81.20	-	-
OS	checkpoint	gaia_os	r81.20	-	-
OS	checkpoint	gaia_os	r81.20	-	-
OS	checkpoint	gaia_os	r81.20	-	-
OS	checkpoint	gaia_os	r81.20	-	-
OS	checkpoint	gaia_os	r81.20	-	-
OS	checkpoint	gaia_os	r81.20	-	-
OS	checkpoint	gaia_os	r81.20	-	-
OS	checkpoint	gaia_os	r81.20	-	-
OS	checkpoint	gaia_os	r81.20	-	-
OS	checkpoint	gaia_os	r81.20	-	-
OS	checkpoint	gaia_os	r81.20	-	-
OS	checkpoint	gaia_os	r81.20	-	-
OS	checkpoint	gaia_os	r81.20	-	-
OS	checkpoint	gaia_os	r81.20	-	-
OS	checkpoint	gaia_os	r81.20	-	-
OS	checkpoint	gaia_os	r81.20	-	-
OS	checkpoint	gaia_os	r81.20	-	-
OS	checkpoint	gaia_os	r81.20	-	-
OS	checkpoint	gaia_os	r81.20	-	-
OS	checkpoint	gaia_os	r81.20	-	-
OS	checkpoint	gaia_os	r81.20	-	-
OS	checkpoint	gaia_os	r81.20	-	-
OS	checkpoint	gaia_os	r82	-	-
OS	checkpoint	gaia_os	r82	-	-
OS	checkpoint	gaia_os	r82	-	-
OS	checkpoint	gaia_os	r82	-	-
OS	checkpoint	gaia_os	r82	-	-
OS	checkpoint	gaia_os	r82	-	-
OS	checkpoint	gaia_os	r82	-	-
OS	checkpoint	gaia_os	r82	-	-
OS	checkpoint	gaia_os	r82	-	-
OS	checkpoint	gaia_os	r82	-	-
OS	checkpoint	gaia_os	r82	-	-
OS	checkpoint	gaia_os	r82	-	-
OS	checkpoint	gaia_os	r82	-	-
OS	checkpoint	gaia_os	r82	-	-
OS	checkpoint	gaia_os	r82	-	-
OS	checkpoint	gaia_os	r82	-	-
OS	checkpoint	gaia_os	r82	-	-
OS	checkpoint	gaia_os	r82	-	-
OS	checkpoint	gaia_os	r82.10	-	-
OS	checkpoint	gaia_os	r82.10	-	-
OS	checkpoint	gaia_os	r82.10	-	-
HW	checkpoint	quantum_spark_1530	-	-	-
HW	checkpoint	quantum_spark_1535	-	-	-
HW	checkpoint	quantum_spark_1550	-	-	-
HW	checkpoint	quantum_spark_1555	-	-	-
HW	checkpoint	quantum_spark_1570	-	-	-
HW	checkpoint	quantum_spark_1570r	-	-	-
HW	checkpoint	quantum_spark_1575	-	-	-
HW	checkpoint	quantum_spark_1575r	-	-	-
HW	checkpoint	quantum_spark_1590	-	-	-
HW	checkpoint	quantum_spark_1595r	-	-	-
HW	checkpoint	quantum_spark_1600	-	-	-
HW	checkpoint	quantum_spark_1800	-	-	-
HW	checkpoint	quantum_spark_1900	-	-	-
HW	checkpoint	quantum_spark_2000	-	-	-
HW	checkpoint	quantum_spark_2530	-	-	-
HW	checkpoint	quantum_spark_2550	-	-	-
HW	checkpoint	quantum_spark_2560	-	-	-
HW	checkpoint	quantum_spark_2570	-	-	-
HW	checkpoint	quantum_spark_2580	-	-	-
HW	checkpoint	quantum_spark_2590	-	-	-

Explore more

Back to dashboard checkpoint CVEs gaia_embedded vulnerabilities

What researchers are saying

CVE-2026-50751

watchTowr[verified]@watchtowrcyberGeneral

The post announces an analysis of Check Point's CVE‑2026‑50751, describing it as an authentication bypass in SSL VPN, but provides no PoC, exploit details, active exploitation evidence, patch information, or debunking claims.

Cyber Security News[verified]@The_Cyber_NewsActive Exploitation

Check Point Research reports that CVE‑2026‑50751, a critical authentication bypass flaw, is actively exploited in the wild, with ransomware activity confirmed.

YogSotho[verified]@YogSoth0Exploit

The post announces an exploit kit for CVE-2026-50751, outlining the full attack chain and technical details of the IKEv1 certificate validation flaw, but does not mention active exploitation or available mitigations.

Horizon3.ai[verified]@Horizon3aiActive Exploitation

The CVE-2026-50751 Check Point VPN authentication bypass is actively exploited in the wild, with a Rapid Response test now available.

FOFA[verified]@fofabotActive Exploitation

CVE‑2026‑50751, a high‑severity IKEv1 certificate validation flaw, is being actively exploited—researchers see thousands of affected URLs on FOFA, and Check Point has issued a patch via its advisory.

dbugs[verified]@ptdbugsActive Exploitation

CVE‑2026‑50751 is an authentication bypass flaw in Check Point VPN that is already being exploited by ransomware operators in the wild, necessitating prompt patching and disabling of IKEv1.

nekono_nanomotoni[verified]@nekono_nahaActive Exploitation

CVE‑2026‑50751 is being actively exploited against Check Point VPNs; a survey revealed that 71.6% of remote hosts still support the deprecated IKEv1 protocol, underscoring the widespread nature of the flaw.

Sekurak[verified]@SekurakActive Exploitation

The post warns that CVE‑2026‑50751, a critical user authentication bypass in IKEv1, is actively exploited (CVSS 9.3/10) and advises disabling IKEv1 or updating devices to mitigate the risk.