CVE-2026-50752 - VPN site to site certificate bypass vulnerability in deprecated IKEv1 key exchange

Please read this important update from Check Point.

Security Alert:

High

Product: Security Gateways, Spark Firewall
Version: R80.20.X (EOS), R80.40 (EOS), R81 (EOS), R81.10 (EOS), R81.10.X, R81.20, R82, R82.00.X, R82.10
OS: Gaia, Gaia Embedded
Last Modified: 2026-06-25

Symptoms

• A vulnerability in the certificate validation logic of the deprecated IKEv1 key exchange method may lead to a man-in-the-middle attack on the VPN site-to-site configuration.
  This vulnerability was discovered by Check Point security research team. There are no reported exploits of this vulnerability

• Vulnerable Configurations

Versions:

• Security Gateways:
  • R82.10 Jumbo Hotfix Take 19 or below
  • R82 Jumbo Hotfix Take 103 or below
  • R81.20 Jumbo Hotfix Take 141 or below
  • R81.10 (EOS)
  • R81 (EOS)
  • R80.40 (EOS)
  • Spark Firewalls: R80.20.X (EOS), R81.10.X, R82.00.X

The vulnerability applies only when all of the following conditions are met:

• VPN site-to-site is enabled.

  • The VPN community uses IKEv1.
  • Gateways participating in the VPN community use certificate-based authentication (pre-shared key authentication is not affected).
  • Gateways are not Dynamic IP (DAIP) gateways.
  • The community is not a Large Scale VPN (LSV) community.

• This issue received the ID CVE-2026-50752.

Solution

Table of Contents:

• Mitigation
• Recommended step - Install Jumbo Hotfix Accumulator
• Hotfix
• Revision History

Mitigation

Configure all VPN communities to use IKEv2 only:

For Security Gateways

1. In SmartConsole, open the VPN community.

2. Set the encryption settings to use IKEv2 only:

3. Install the policy on all Security Gateways in the community.

For Locally Managed Spark Firewall

1. In Spark WebUI, go to VPN > VPN Sites

2. For each VPN Site, go to Advanced tab

3. From the drop-down menu, change the Encryption Method to IKEv2

4. Click Save

For Spark Management

1. In Check Point Portal, go to Spark Management service

2. Go to COMMUNITY

3. In Community > VPN Settings, change the Encryption Method to IKEv2

4. Click Save

Recommended step - Install Jumbo Hotfix Accumulator

The fix is included in these Jumbo Hotfix Accumulators:

Hotfix R81.20, R82, and R82.10

Check Point can supply a Hotfix for R81.20, R82, and R82.10. Download the Hotfix relevant to your version:

For Security Gateway / Security Group Member

For Check Point Spark Firewalls

Important: For Centrally Managed Appliances, before installing these Builds, make sure your Security Management is updated with solution for Certificate and CRL validation.

Revision History