Check Point CVE-2026-50752: VPN Site-to-Site Certificate Bypass via IKEv1

Vulnerability Overview Vulnerability Name: CVE-2026-50752 Vulnerability Type: VPN site-to-site certificate bypass vulnerability Affected Versions: Check Point Security Gateways and Spark Firewalls using the deprecated IKEv1 key exchange Discovered By: Check Point Security Research Team Report Status: No known exploits Scope Affected Products: - Security Gateways: R82.10 Jumbo Hotfix Take 19 or lower - Spark Firewalls: R80.20.X (EOS), R81.10.X, R82.00.X Conditions: - Site-to-site VPN is enabled - VPN community uses IKEv1 - Gateways participating in the VPN community use certificate-based authentication (pre-shared key authentication is not affected) - Gateway is not a Dynamic IP (DAIPI) gateway - Community is not a Large Scale VPN (LSVP) community Remediation Mitigations: - Configure all VPN communities to use IKEv2 only - For Security Gateways: 1. Open the VPN community in SmartConsole 2. Set encryption settings to use IKEv2 only 3. Install the policy on all security gateways in the community - For locally managed Spark Firewalls: 1. In the Spark WebUI, go to VPN > VPN Sites 2. For each VPN site, go to the Advanced tab 3. From the dropdown menu, change the encryption method to IKEv2 4. Click Save - For Spark Management: 1. In the Check Point Portal, go to Spark Management service 2. Go to COMMUNITY 3. In Community > VPN Settings, change the encryption method to IKEv2 4. Click Save Recommended Steps: - Install Jumbo Hotfix Accumulator - Applicable for R81.10 Jumbo Hotfix Accumulator Take 187 - Patches for other versions to be added soon Download Links Security Gateway / Security Group Member: - R82.10 Jumbo Hotfix Accumulator Take 19 - R82.10 Jumbo Hotfix Accumulator Take 6 - R82 Jumbo Hotfix Accumulator Take 103 - R82 Jumbo Hotfix Accumulator Take 91 - R81.20 Jumbo Hotfix Accumulator Take 141 - R81.20 Jumbo Hotfix Accumulator Take 127 - R81.20 Jumbo Hotfix Accumulator Take 120 - R81.20 Jumbo Hotfix Accumulator Take 118 - R81.20 Jumbo Hotfix Accumulator Take 113 - R81.20 Jumbo Hotfix Accumulator Take 105 - R81.20 Jumbo Hotfix Accumulator Take 92 Check Point Spark Firewalls: - R82.00.10 Build 998002216 for Local Installation - R82.00.10 Build 998002216 for Central Deployment in SmartConsole - R82.00.10 Build 998002216 for SmartUpdate - R81.10.17 Build 996004901 for Local Installation - R81.10.17 Build 996004901 for Central Deployment in SmartConsole - R81.10.17 Build 996004901 for SmartUpdate Revision History 2026-06-11: Added Recommended step - R81.10 Jumbo Hotfix Accumulator Take 187 Article Properties Access Level: General Severity: High Status: Approved Date Created: 2026-06-07 Last Modified: 2026-06-11 Page Feedback Was this helpful?: Yes / No Customer Support Did not find what you were looking for?: Open a service request Footer Copyright: ©1994-2026 Check Point Software Technologies Ltd. All rights reserved. Privacy Policy: Privacy Policy Social Media Follow Us: Instagram, Facebook, X, LinkedIn, YouTube Other Get a Demo: Get a Demo Contact Sales: Contact Sales Support: Support Log In: Log In Search: Search support articles, tools or guides. Solutions Mitigations: Configure all VPN communities to use IKEv2 only. Recommended Steps: Install Jumbo Hotfix Accumulator. Vulnerability Details Vulnerability Description: A vulnerability in the certificate validation logic of the deprecated IKEv1 key exchange method may lead to a man-in-the-middle attack on the VPN site-to-site configuration. Discovered By: Check Point security research team. Report Status: There are no reported exploits of this vulnerability. Affected Configuration Versions: - Security Gateways: R82.10 Jumbo Hotfix Take 19 or below, R82 Jumbo Hotfix Take 103 or below, R81.20 Jumbo Hotfix Take 141 or below, R81.10 (EOS), R81 (EOS), R80.40 (EOS) - Spark Firewalls: R80.20.X (EOS), R81.10.X, R82.00.X Conditions: - VPN site-to-site is enabled. - The VPN community uses IKEv1. - Gateways participating in the VPN community use certificate-based authentication (pre-shared key authentication is not affected). - Gateways are not Dynamic IP (DAIPI) gateways. - The community is not a Large Scale VPN (LSVP) community. Solutions Mitigations: Configure all VPN communities to use IKEv2 only. Recommended Steps: Install Jumbo Hotfix Accumulator. Download Links Security Gateway / Security Group Member: - R82.10 Jumbo Hotfix Accumulator Take 19 - R82.10 Jumbo Hotfix Accumulator Take 6 - R82 Jumbo Hotfix Accumulator Take 103 - R82 Jumbo Hotfix Accumulator Take 91 - R81.20 Jumbo Hotfix Accumulator Take 141 - R81.20 Jumbo Hotfix Accumulator Take 127 - R81.20 Jumbo Hotfix Accumulator Take 120 - R81.20 Jumbo Hotfix Accumulator Take 118 - R81.20 Jumbo Hotfix Accumulator Take 113 - R81.20 Jumbo Hotfix Accumulator Take 105 - R81.20 Jumbo Hotfix Accumulator Take 92 Check Point Spark Firewalls: - R82.00.10 Build 998002216 for Local Installation - R82.00.10 Build 998002216 for Central Deployment in SmartConsole - R82.00.10 Build 998002216 for SmartUpdate - R81.10.17 Build 9960

Goal Reached Thanks to every supporter — we hit 100%!

Check Point CVE-2026-50752: VPN Site-to-Site Certificate Bypass via IKEv1