Authentication bypass in Check Point Security Gateway (CVE-2026-50751) — VPN access without a password, CVSS 9.3

CVE-2026-50751 is an improper-authentication vulnerability (CWE-287) in Check Point Security Gateway (Check Point's firewall / VPN gateway products). It was added to CISA's KEV catalog on June 8, 2026.

Per NVD, the vulnerability is in IKEv1 key exchange, and an unauthenticated remote attacker can bypass user authentication and establish a remote-access VPN connection without a valid user password. IKE (Internet Key Exchange) is the key-exchange protocol for IPsec VPNs; bypassing authentication here means impersonating a legitimate user to enter the internal network.

Security gateways / VPN devices sit at the boundary between the internal network and the outside and are internet-exposed. Breaking through one without authentication hands an attacker an entry point for internal intrusion. Authentication bypasses on perimeter-defense products have repeatedly been exploited as the initial access vector in ransomware and state-linked attacks, so priority is high.

Key response: apply fixes/mitigations per Check Point's official instructions. For cloud use, follow BOD 22-01, and consider disabling the affected feature if mitigations are unavailable. Internet-exposed VPNs/gateways are especially high priority, and reviewing VPN connection logs is recommended. The federal civilian remediation deadline was a short June 11, 2026.