CVE-2026-50751: User Authentication Bypass in VPN Remote Access and Mobile Access

Synopsis

An authentication bypass vulnerability affects Check Point Quantum Security Gateway and Spark Firewalls running affected firmware versions. A remote attacker with no credentials can exploit a logic flaw in certificate validation during deprecated IKEv1 key exchange to skip password authentication entirely and establish a fully authenticated remote access VPN session. Successful exploitation gives the attacker a valid VPN tunnel into protected network segments without supplying any user password. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment Check Point publishes a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the VPN gateway's IKEv1 endpoint over the network; the service is typically internet-exposed, making remote exploitation straightforward.

• AuthenticationNot required

  No credentials are needed; the vulnerability itself allows the attacker to bypass password authentication entirely.

• Victim interactionNot required

  No user action or social engineering is needed; the attacker initiates the IKEv1 handshake directly.

• Attack complexityDetail

  Exploit complexity is low: no race conditions, memory layout dependencies, or special environmental factors are required to trigger the bypass reliably.

Blast Radius

• Attacker establishes a fully authenticated VPN tunnel into protected network segments without possessing a valid user password.
• Attacker gains read access to internal network resources, hosts, and services reachable from the VPN address pool, including potentially sensitive internal data.
• Attacker can make limited modifications to network-accessible resources from within the trusted VPN context, consistent with a low-integrity CVSS rating.
• Scope is changed (CVSS S:C): the attacker escapes the VPN authentication boundary and reaches systems in network segments that should be isolated from untrusted traffic.