A critical authentication bypass vulnerability (CVE-2026-50751, CVSS 9.3) in Check Point Security Gateways and Spark Firewalls allows a remote attacker to bypass user authentication when specific legacy VPN configurations are enabled. The article indicates affected versions include Security Gateways up to R82.10 Jumbo Hotfix Take 19 and Spark Firewalls up to R82.00.X, contingent on enabling VPN Remote/Mobile Access with IKEv1 and legacy clients. Check Point has provided fixes and mitigations detailed in their support articles SK185033 and SK185035.
Multiple vulnerabilities were identified in Check Point Products. A remote attacker could exploit some of these vulnerabilities to trigger security restriction bypass on the targeted system. Note: CVE-2026-50751 is being exploited in the wild. An attacker can bypass user authentication by... Impact Security Restriction Bypass System / Technologies affected Security Gateways Spark Firewalls For CVE-2026-50751 Vulnerable Configurations Versions: Security Gateways: R82.10 Jumbo Hotfix Take 19 or below R82 Jumbo Hotfix Take 103 or below R81.20 Jumbo Hotfix Take 141 or below R81.10 (EOS) R81 (EOS) R80.40 (EOS) Spark Firewalls: R80.20.X (EOS), R81.10.X, R82.00.X When (all required) : VPN Remote Access or Mobile Access is enabled IKEv1 is enabled for remote access Gateways accept legacy Remote Access clients Gateways do not demand a machine certificate for connections Solutions Before installation of the software, please visit the software vendor web-site for more details. Apply fixes or mitigations issued by the vendor: https://support.checkpoint.com/results/sk/sk185033/ https://support.checkpoint.com/results/sk/sk185035/