> Source: [sk185035](https://support.checkpoint.com/results/sk/sk185035)
# sk185035 - CVE-2026-50752 - VPN site to site certificate bypass vulnerability in deprecated IKEv1 key exchange
| Property | Value |
|----------|-------|
| Solution ID | sk185035 |
| Date Created | 2026-06-07 |
| Last Modified | 2026-06-25 |
| Technical Level | General |
| Products | Security Gateway, Spark Firewall (Locally Managed) |
| Versions | R82.10, R82, R81.20, R81.10 (EOS), R82.00.X, R81.10.X, R81 (EOS) |
| OS | Gaia |
## Symptoms
- * A vulnerability in the certificate validation logic of the [deprecated IKEv1 key exchange method](https://www.ietf.org/archive/id/draft-ietf-ipsecme-ikev1-algo-to-historic-07.html) may lead to a man-in-the-middle attack on the VPN site-to-site configuration.
This vulnerability was discovered by Check Point security research team. There are no reported exploits of this vulnerability
* **Vulnerable Configurations**
Versions:
* Security Gateways:
* R82.10 Jumbo Hotfix Take 19 or below
* R82 Jumbo Hotfix Take 103 or below
* R81.20 Jumbo Hotfix Take 141 or below
* R81.10 (EOS)
* R81 (EOS)
* R80.40 (EOS)
* Spark Firewalls: R80.20.X (EOS), R81.10.X, R82.00.X
The vulnerability applies only when all of the following conditions are met:
* VPN site-to-site is enabled.
* The VPN community uses IKEv1.
* Gateways participating in the VPN community use certificate-based authentication (pre-shared key authentication is not affected).
* Gateways are not Dynamic IP (DAIP) gateways.
* The community is not a Large Scale VPN (LSV) community.
* This issue received the ID [CVE-2026-50752](https://www.cve.org/CVERecord?id=CVE-2026-50752).
## Solution
**Table of Contents:**
* Mitigation
* Recommended step - Install Jumbo Hotfix Accumulator
* Hotfix
* Revision History
### Mitigation {#TARGET_ID_2}
Configure all VPN communities to use IKEv2 only:
**For Security Gateways**
1. In **SmartConsole** , open the **VPN community** .
2. Set the encryption settings to use **IKEv2** only:
3. Install the policy on all Security Gateways in the community.
**For Locally Managed Spark Firewall**
1. In **Spark WebUI** , go to **VPN** \> **VPN Sites**
2. For each VPN Site, go to **Advanced** tab
3. From the drop-down menu, change the **Encryption Method** to **IKEv2**
4. Click **Save**
**For Spark Management**
1. In **Check Point Portal** , go to **Spark Management** service
2. Go to **COMMUNITY**
3. In **Community** \> **VPN Settings** , change the **Encryption Method** to **IKEv2**
4. Click **Save**
### Recommended step - Install Jumbo Hotfix Accumulator {#TARGET_ID_7}
The fix is included in these Jumbo Hotfix Accumulators:
|-------------------------------------|-------------------------------------------------------------------------------|
| Version | Take # |
| **R82.10 Jumbo Hotfix Accumulator** | [Take 24](https://sc1.checkpoint.com/documents/Jumbo_HFA/R82.10/Default.htm) |
| **R82 Jumbo Hotfix Accumulator** | [Take 107](https://sc1.checkpoint.com/documents/Jumbo_HFA/R82/Default.htm) |
| **R81.20 Jumbo Hotfix Accumulator** | [Take 146](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81.20/Default.htm) |
| **R81.10 Jumbo Hotfix Accumulator** | [Take 187](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81.10/Default.htm) |
{#Unique_ID_HotfixesTable}
### Hotfix R81.20, R82, and R82.10 {#TARGET_ID_8}
Check Point can supply a Hotfix for R81.20, R82, and R82.10. Download the Hotfix relevant to your version:
**For Security Gateway / Security Group Member**
|--------------------------------------------------|------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| **Hotfix on top** | **Take #** | **Download link** |
| **R82.10** Jumbo Hotfix Accumulator Take **19** | 3 | [](https://support.checkpoint.com/results/download/143634) (TAR) [](https://support.checkpoint.com/results/download/143633) (TAR for 3900 appliances) |
| **R82.10** Jumbo Hotfix Accumulator Take **6** | 2 | [](https://support.checkpoint.com/results/download/143629) (TAR) [](https://support.checkpoint.com/results/download/143628) (TAR for 3900 appliances) |
| **R82** Jumbo Hotfix Accumulator Take **103** | 2 | [](https://support.checkpoint.com/results/download/143639) (TAR) |
| **R82** Jumbo Hotfix Accumulator Take **91** | 2 | [](https://support.checkpoint.com/results/download/143624) (TAR) |
| **R82** Jumbo Hotfix Accumulator Take**60** | 3 | [](https://support.checkpoint.com/results/download/143733) (TAR) |
| **R82** Jumbo Hotfix Accumulator Take **44** | 1 | [](https://support.checkpoint.com/results/download/143708) (TAR) |
| **R81.20** Jumbo Hotfix Accumulator Take **141** | 2 | [](https://support.checkpoint.com/results/download/143620) (TAR) |
| **R81.20** Jumbo Hotfix Accumulator Take **127** | 2 | [](https://support.checkpoint.com/results/download/143617) (TAR) |
| **R81.20** Jumbo Hotfix Accumulator Take **120** | 2 | [](https://support.checkpoint.com/results/download/143614) (TAR) |
| **R81.20** Jumbo Hotfix Accumulator Take **118** | 1 | [](https://support.checkpoint.com/results/download/143680) (TAR) |
| **R81.20** Jumbo Hotfix Accumulator Take **113** | 2 | [](https://support.checkpoint.com/results/download/143612) (TAR) |
| **R81.20** Jumbo Hotfix Accumulator Take **105** | 1 | [](https://support.checkpoint.com/results/download/143679) (TAR) |
| **R81.20** Jumbo Hotfix Accumulator Take **92** | 1 | [](https://support.checkpoint.com/results/download/143698) (TAR) |
{#Unique_ID_HotfixesTable}
**For Check Point Spark Firewalls**
|----------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------|
| **Download Package** | **15X5/1575R Appliances** | **1595R Appliances** | **1600/1800/ 1900/2000 Appliances** | **2530/2550 Appliances** | **2560/2570/ 2580/2590 Appliances** |
| **R82.00.10 Build 998002216 for Local Installation** | [](https://support.checkpoint.com/results/download/143595) (IMG) | [](https://support.checkpoint.com/results/download/143596) (IMG) | [](https://support.checkpoint.com/results/download/143597) (IMG) | [](https://support.checkpoint.com/results/download/143598) (IMG) | [](https://support.checkpoint.com/results/download/143599) (IMG) |
| **R82.00.10 Build 998002216 for Central Deployment in SmartConsole** | [](https://support.checkpoint.com/results/download/143656) (TAR) | [](https://support.checkpoint.com/results/download/143657) (TAR) | [](https://support.checkpoint.com/results/download/143658) (TAR) | [](https://support.checkpoint.com/results/download/143659) (TAR) | [](https://support.checkpoint.com/results/download/143660) (TAR) |
| **R82.00.10 Build 998002216 for SmartUpdate** | [](https://support.checkpoint.com/results/download/143648) (TGZ) | [](https://support.checkpoint.com/results/download/143649) (TGZ) | [](https://support.checkpoint.com/results/download/143650) (TGZ) | [](https://support.checkpoint.com/results/download/143651) (TGZ) | [](https://support.checkpoint.com/results/download/143652) (TGZ) |
|----------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------|
| **Download Package** | **1500 Appliances** | **1595R Appliances** | **1600/1800/ 1900/2000 Appliances** |
| **R81.10.17 Build 996004901 for Local Installation** | [](https://support.checkpoint.com/results/download/143592) (IMG) | [](https://support.checkpoint.com/results/download/143593) (IMG) | [](https://support.checkpoint.com/results/download/143594) (IMG) |
| **R81.10.17 Build 996004901 for Central Deployment in SmartConsole** | [](https://support.checkpoint.com/results/download/143661) (TAR) | [](https://support.checkpoint.com/results/download/143662) (TAR) | [](https://support.checkpoint.com/results/download/143663) (TAR) |
| **R81.10.17 Build 996004901 for SmartUpdate** | [](https://support.checkpoint.com/results/download/143653) (TGZ) | [](https://support.checkpoint.com/results/download/143654) (TGZ) | [](https://support.checkpoint.com/results/download/143655) (TGZ) |
**Important:** For Centrally Managed Appliances, before installing these Builds, make sure your Security Management is updated with solution for [Certificate and CRL validation](https://support.checkpoint.com/results/sk/sk184766).
### Revision History {#Revision History}
|-------------|-----------------------------------------------------------------------------------------------------------------------------------------------------|
| Date | Description |
| 15 Jun 2026 | Added Recommended step * R82.10 Jumbo Hotfix Accumulator Take 24 * R82 Jumbo Hotfix Accumulator Take 107 * R81.20 Jumbo Hotfix Accumulator Take 146 |
| 14 Jun 2026 | Added Hotfixes for * R82 Jumbo Hotfix Accumulator Take 60 * R82 Jumbo Hotfix Accumulator Take 44 |
| 11 Jun 2026 | Added Recommended step - R81.10 Jumbo Hotfix Accumulator Take 187. |
---
# Agent Instructions
This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.
## Navigating This Knowledge Base
- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content