> Source: [sk185033](https://support.checkpoint.com/results/sk/sk185033)
# sk185033 - CVE-2026-50751 - User Authentication bypass on VPN Remote Access and Mobile Access in deprecated IKEv1 key exchange
| Property | Value |
|----------|-------|
| Solution ID | sk185033 |
| Date Created | 2026-06-04 |
| Last Modified | 2026-07-07 |
| Technical Level | General |
| Products | Security Gateway, Spark Firewall (Locally Managed) |
| Versions | R82.10, R82, R81.20, R81.10 (EOS), R82.00.X, R81.10.X, R81 (EOS) |
| OS | Gaia |
## Symptoms
- * An attacker can bypass user authentication by exploiting a logic flow weakness in the Remote Access and Mobile Access certificate validation and establish a remote access VPN connection without a valid user password. Check Point is aware of this vulnerability being exploited in the wild.
* **Vulnerable Configurations**
Versions:
* Security Gateways:
* R82.10 Jumbo Hotfix Take 19 or below
* R82 Jumbo Hotfix Take 103 or below
* R81.20 Jumbo Hotfix Take 141 or below
* R81.10 (EOS)
* R81 (EOS)
* R80.40 (EOS)
* Spark Firewalls: R80.20.X (EOS), R81.10.X, R82.00.X
When (all required) :
1. VPN Remote Access or Mobile Access is enabled
2. IKEv1 is enabled for remote access
3. Gateways accept legacy Remote Access clients
4. Gateways do not demand a machine certificate for connections
* This issue received the ID [CVE-2026-50751](https://www.cve.org/CVERecord?id=CVE-2026-50751).
## Solution
**Table of Contents:**
* How to Identify an Attack
* Mitigation
* Option 1 - Remove support for legacy remote access client
* Option 2 - Configure Global properties for Remote Access VPN Authentication to IKEv2 only
* Option 3 - Set the Machine Certificate Authentication as mandatory
* Recommended step - Install Jumbo Hotfix Accumulator
* Hotfix
* Revision History
### How to Identify an Attack {#TARGET_ID_1}
Search your Check Point **SmartConsole** logs for possible VPN certificate authentication attempts associated with the observed attacker infrastructure and certificate subject names.
**SmartConsole** supports custom log searches from **Logs \& Monitor** / **Logs \& Events**.
1.
#### Recommended time range
Search at least this period: `2026-05-07` through `2026-06-05`
**Note** - For broader assurance, you may search the last 60 days.
2.
#### Hunt for attacker IP addresses
In the **SmartConsole** , go to **Logs \& Monitor** / **Logs \& Events**, and search for events where either the source IP or destination IP matches one of the known attacker IP addresses.
**Attacker IP addresses
IOCs observed from May 7 to June 8, 2026**
* 45.77.149.152
* 209.182.225.136
* 38.60.157.139
* 162.33.177.101
* 45.76.26.42
* 144.208.127.155
* 38.54.88.201
* 38.54.107.167
* 66.42.99.200
**IOCs added on June 9, 2026**
* 45.63.104.106
* 45.61.136.173
**IOCs added on June 10, 2026**
* 146.71.81.184
**IOCs added on June 11, 2026**
* 208.123.119.167
* 64.176.228.109
* 158.247.195.147
* 144.208.127.134
**SmartConsole query**
`(src:45.77.149.152 OR dst:45.77.149.152 OR src:209.182.225.136 OR dst:209.182.225.136 OR src:38.60.157.139 OR dst:38.60.157.139 OR src:162.33.177.101 OR dst:162.33.177.101 OR src:45.76.26.42 OR dst:45.76.26.42 OR src:144.208.127.155 OR dst:144.208.127.155 OR src:38.54.88.201 OR dst:38.54.88.201 OR dst:38.54.107.167 OR dst:66.42.99.200 OR dst:45.63.104.106 OR dst:45.61.136.173 OR dst:146.71.81.184 OR dst:208.123.119.167 OR dst:64.176.228.109 OR dst:158.247.195.147 OR dst:144.208.127.134)`
3.
#### Hunt specifically for VPN / IKE activity
After identifying matching logs, you should focus on VPN and IKE-related events, especially `Key Install`.
**Focused Key Install query**
`action:"Key Install" AND (src:45.77.149.152 OR dst:45.77.149.152 OR src:209.182.225.136 OR dst:209.182.225.136 OR src:38.60.157.139 OR dst:38.60.157.139 OR src:162.33.177.101 OR dst:162.33.177.101 OR src:45.76.26.42 OR dst:45.76.26.42 OR src:144.208.127.155 OR dst:144.208.127.155 OR src:38.54.88.201 OR dst:38.54.88.201 OR dst:38.54.107.167 OR dst:66.42.99.200 OR dst:45.63.104.106 OR dst:45.61.136.173 OR dst:146.71.81.184 OR dst:208.123.119.167 OR dst:64.176.228.109 OR dst:158.247.195.147 OR dst:144.208.127.134)`
**Quick Mode / IKE query**
Use this to find IKE events where the log record contains `Quick`:
`action:"Key Install" AND Quick AND (src:45.77.149.152 OR dst:45.77.149.152 OR src:209.182.225.136 OR dst:209.182.225.136 OR src:38.60.157.139 OR dst:38.60.157.139 OR src:162.33.177.101 OR dst:162.33.177.101 OR src:45.76.26.42 OR dst:45.76.26.42 OR src:144.208.127.155 OR dst:144.208.127.155 OR src:38.54.88.201 OR dst:38.54.88.201 OR dst:38.54.107.167 OR dst:66.42.99.200 OR dst:45.63.104.106 OR dst:45.61.136.173 OR dst:146.71.81.184 OR dst:208.123.119.167 OR dst:64.176.228.109 OR dst:158.247.195.147 OR dst:144.208.127.134)`
A successful exploit requires a Quick mode key install.
4. **IPS signature triggered**
To improve visibility into attack attempts and scanning activity, we recommend enabling the IPS protection **IKEv1 Remote Access Authentication Bypass PoC Exploit (CVE-2026-50751)**.
This protection is not a remediation. You should use it in addition to installing the hotfix or applying the recommended mitigation steps.
For more incident investigation steps, refer to the [IKEv1 Certificate Authentication Bypass Hunting Guide](https://sc1.checkpoint.com/documents/PDF/AuthBypassDetectionGuide.pdf).
### Mitigation Options {#TARGET_ID_2}
Implement one of these mitigation actions:
#### Option 1 - Remove support for legacy Remote Access client connections {#TARGET_ID_3}
1. In **SmartConsole** , open the **Security Gateway** object properties.
2. Go to **VPN Clients** \> **Authentication** .
3. Clear the **Allow older clients to connect to this gateway** checkbox:
4. In the **Multiple Authentication Clients Settings** section, define the authentication methods required. See the [Mobile Access Administration Guide](https://sc1.checkpoint.com/documents/R82/WebAdminGuides/EN/CP_R82_MobileAccess_AdminGuide/Content/Topics-MABG/Multiple-Login-Options.htm) for details.
5. **If Mobile Access is enabled:** In the **Security Gateway** object properties, go to **Mobile Access** \> **Authentication** and clear the **Allow older clients to connect to this gateway** checkbox:
6. Click **OK** and **Install the Security Policy**.
**Notes** :
* This change will prevent certain clients, such as StrongSWAN, LT2P, and old clients running on legacy systems (such as ATMs), from connecting.
* This mitigation option is not relevant for locally managed Spark Firewall.
#### Option 2 - Configure Global properties for Remote Access VPN Authentication to IKEv2 only
For Security Gateways {#TARGET_ID_4}
1. In **SmartConsole** , click menu icon and select **Global properties** .
2. Go to **Remote Access** \> **VPN Authentication** .
3. In Encryption method, select **IKEv2 only** checkbox.
4. Click **OK** and **Install the Security Policy**.
For information on IKEv2 support on Remote Access VPN clients, see [sk166415](https://support.checkpoint.com/results/sk/sk166415).
**For locally managed Spark Firewall R82.00.X and R81.10.X with StrongSWAN:
Note:** Remote Access VPN with IKEv2 is not supported on R81.10.X if you do not use StrongSWAN client.
1. In **Spark WebUI** , go to **Device** \> **Advanced Setting**
2. In **Remote Access VPN - Encryption Method** advanced setting, from the drop-down menu, select **IKEv2:**
3. Click **Save**
#### Option 3 - Set the Machine Certificate Authentication as mandatory {#TARGET_ID_6}
1. In **SmartConsole** , open the **Security Gateway** object properties.
2. Go to **VPN Clients** \> **Authentication** .
3. In the **Machine Certificate Authentication** section, select **Mandatory** .
4. Click **OK** and **Install the Security Policy**.
**Note:** This mitigation option is not relevant for locally managed Spark Firewall.
### Recommended step - Install Jumbo Hotfix Accumulator {#TARGET_ID_7}
The fix is included in these Jumbo Hotfix Accumulators:
|-------------------------------------|-------------------------------------------------------------------------------|
| Version | Take # |
| **R82.10 Jumbo Hotfix Accumulator** | [Take 24](https://sc1.checkpoint.com/documents/Jumbo_HFA/R82.10/Default.htm) |
| **R82 Jumbo Hotfix Accumulator** | [Take 107](https://sc1.checkpoint.com/documents/Jumbo_HFA/R82/Default.htm) |
| **R81.20 Jumbo Hotfix Accumulator** | [Take 146](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81.20/Default.htm) |
| **R81.10 Jumbo Hotfix Accumulator** | [Take 187](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81.10/Default.htm) |
{#Unique_ID_HotfixesTable}
### Hotfix for R81.20, R82, and R82.10 {#TARGET_ID_8}
Check Point can supply a Hotfix for R81.20, R82, and R82.10. Download the Hotfix relevant to your version:
**For Security Gateway / Security Group Member**
|--------------------------------------------------|------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| **Hotfix on top** | **Take #** | **Download link** |
| **R82.10** Jumbo Hotfix Accumulator Take **19** | 3 | [](https://support.checkpoint.com/results/download/143634) (TAR) [](https://support.checkpoint.com/results/download/143633) (TAR for 3900 appliances) |
| **R82.10** Jumbo Hotfix Accumulator Take **6** | 2 | [](https://support.checkpoint.com/results/download/143629) (TAR) [](https://support.checkpoint.com/results/download/143628) (TAR for 3900 appliances) |
| **R82** Jumbo Hotfix Accumulator Take **103** | 2 | [](https://support.checkpoint.com/results/download/143639) (TAR) |
| **R82** Jumbo Hotfix Accumulator Take **91** | 2 | [](https://support.checkpoint.com/results/download/143624) (TAR) |
| **R82** Jumbo Hotfix Accumulator Take**60** | 3 | [](https://support.checkpoint.com/results/download/143733) (TAR) |
| **R82** Jumbo Hotfix Accumulator Take **44** | 1 | [](https://support.checkpoint.com/results/download/143708) (TAR) |
| **R81.20** Jumbo Hotfix Accumulator Take **141** | 2 | [](https://support.checkpoint.com/results/download/143620) (TAR) |
| **R81.20** Jumbo Hotfix Accumulator Take **127** | 2 | [](https://support.checkpoint.com/results/download/143617) (TAR) |
| **R81.20** Jumbo Hotfix Accumulator Take **120** | 2 | [](https://support.checkpoint.com/results/download/143614) (TAR) |
| **R81.20** Jumbo Hotfix Accumulator Take **118** | 1 | [](https://support.checkpoint.com/results/download/143680) (TAR) |
| **R81.20** Jumbo Hotfix Accumulator Take **113** | 2 | [](https://support.checkpoint.com/results/download/143612) (TAR) |
| **R81.20** Jumbo Hotfix Accumulator Take **105** | 1 | [](https://support.checkpoint.com/results/download/143679) (TAR) |
| **R81.20** Jumbo Hotfix Accumulator Take **92** | 1 | [](https://support.checkpoint.com/results/download/143698) (TAR) |
{#Unique_ID_HotfixesTable}
**For Check Point Spark Firewalls**
|----------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------|
| **Download Package** | **15X5/1575R Appliances** | **1595R Appliances** | **1600/1800/ 1900/2000 Appliances** | **2530/2550 Appliances** | **2560/2570/ 2580/2590 Appliances** |
| **R82.00.10 Build 998002216 for Local Installation** | [](https://support.checkpoint.com/results/download/143595) (IMG) | [](https://support.checkpoint.com/results/download/143596) (IMG) | [](https://support.checkpoint.com/results/download/143597) (IMG) | [](https://support.checkpoint.com/results/download/143598) (IMG) | [](https://support.checkpoint.com/results/download/143599) (IMG) |
| **R82.00.10 Build 998002216 for Central Deployment in SmartConsole** | [](https://support.checkpoint.com/results/download/143656) (TAR) | [](https://support.checkpoint.com/results/download/143657) (TAR) | [](https://support.checkpoint.com/results/download/143658) (TAR) | [](https://support.checkpoint.com/results/download/143659) (TAR) | [](https://support.checkpoint.com/results/download/143660) (TAR) |
| **R82.00.10 Build 998002216 for SmartUpdate** | [](https://support.checkpoint.com/results/download/143648) (TGZ) | [](https://support.checkpoint.com/results/download/143649) (TGZ) | [](https://support.checkpoint.com/results/download/143650) (TGZ) | [](https://support.checkpoint.com/results/download/143651) (TGZ) | [](https://support.checkpoint.com/results/download/143652) (TGZ) |
|----------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------|
| **Download Package** | **1500 Appliances** | **1595R Appliances** | **1600/1800/ 1900/2000 Appliances** |
| **R81.10.17 Build 996004901 for Local Installation** | [](https://support.checkpoint.com/results/download/143592) (IMG) | [](https://support.checkpoint.com/results/download/143593) (IMG) | [](https://support.checkpoint.com/results/download/143594) (IMG) |
| **R81.10.17 Build 996004901 for Central Deployment in SmartConsole** | [](https://support.checkpoint.com/results/download/143661) (TAR) | [](https://support.checkpoint.com/results/download/143662) (TAR) | [](https://support.checkpoint.com/results/download/143663) (TAR) |
| **R81.10.17 Build 996004901 for SmartUpdate** | [](https://support.checkpoint.com/results/download/143653) (TGZ) | [](https://support.checkpoint.com/results/download/143654) (TGZ) | [](https://support.checkpoint.com/results/download/143655) (TGZ) |
**Important:** For Centrally Managed Appliances, before installing these Builds, make sure your Security Management is updated with solution for [Certificate and CRL validation](https://support.checkpoint.com/results/sk/sk184766).
### Revision History {#Revision History}
|-------------|-----------------------------------------------------------------------------------------------------------------------------------------------------|
| Date | Description |
| 15 Jun 2026 | Added Recommended step * R82.10 Jumbo Hotfix Accumulator Take 24 * R82 Jumbo Hotfix Accumulator Take 107 * R81.20 Jumbo Hotfix Accumulator Take 146 |
| 14 Jun 2026 | Added Hotfixes for * R82 Jumbo Hotfix Accumulator Take 60 * R82 Jumbo Hotfix Accumulator Take 44 |
| 13 Jun 2026 | * Added more Attacker IP addresses * Added "How to Identify an Attack" \> "(4) IPS signature triggered" section |
| 11 Jun 2026 | Added Recommended step - R81.10 Jumbo Hotfix Accumulator Take 187. |
---
# Agent Instructions
This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.
## Navigating This Knowledge Base
- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content