cvelistv5 - cve-2026-50752

CVE-2026-50752 (GCVE-0-2026-50752)

Vulnerability from cvelistv5

Published

2026-06-08 11:00

Modified

2026-06-10 13:36

Severity ?

7.4 (High) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

CWE

CWE-295 - Improper Certificate Validation.

Summary

A weakness in the certificate validation logic of the deprecated IKEv1 key exchange may allow an unauthenticated attacker positioned as a man-in-the-middle to bypass certificate validation in VPN site-to-site connections that use certificate-based authentication. Successful exploitation could allow interception or modification of traffic traversing the VPN tunnel.

References

URL

Tags

https://support.checkpoint.com/results/sk/sk185035

Impacted products

Vendor

Product

Version

checkpoint

Quantum Security Gateway

Version: R82.10 with Jumbo Hotfix Take 19 or below
Version: R82 with Jumbo Hotfix Take 103 or below
Version: R81.20 with Jumbo Hotfix Take 141 or below
Version: R81.10, R81, and R80.40

checkpoint

Spark Firewalls

Version: R80.20.X, R81.10.X, and R82.00.X

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-50752",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-09T03:55:37.901004Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-10T13:36:24.946Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Quantum Security Gateway",
          "vendor": "checkpoint",
          "versions": [
            {
              "status": "affected",
              "version": "R82.10 with Jumbo Hotfix Take 19 or below"
            },
            {
              "status": "affected",
              "version": "R82 with Jumbo Hotfix Take 103 or below"
            },
            {
              "status": "affected",
              "version": "R81.20 with Jumbo Hotfix Take 141 or below"
            },
            {
              "status": "affected",
              "version": "R81.10, R81, and R80.40"
            }
          ]
        },
        {
          "product": "Spark Firewalls",
          "vendor": "checkpoint",
          "versions": [
            {
              "status": "affected",
              "version": "R80.20.X, R81.10.X, and R82.00.X"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A weakness in the certificate validation logic of the deprecated IKEv1 key exchange may allow an unauthenticated attacker positioned as a man-in-the-middle to bypass certificate validation in VPN site-to-site connections that use certificate-based authentication. Successful exploitation could allow interception or modification of traffic traversing the VPN tunnel."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-295",
              "description": "CWE-295: Improper Certificate Validation.",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-08T11:00:38.563Z",
        "orgId": "897c38be-0345-43cd-b6cf-fe179e0c4f45",
        "shortName": "checkpoint"
      },
      "references": [
        {
          "url": "https://support.checkpoint.com/results/sk/sk185035"
        }
      ],
      "title": "Certificate Validation Bypass in VPN Site-to-Site Connections Using IKEv1"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "897c38be-0345-43cd-b6cf-fe179e0c4f45",
    "assignerShortName": "checkpoint",
    "cveId": "CVE-2026-50752",
    "datePublished": "2026-06-08T11:00:38.563Z",
    "dateReserved": "2026-06-07T09:42:08.252Z",
    "dateUpdated": "2026-06-10T13:36:24.946Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-50752\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-06-09T03:55:37.901004Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-06-08T12:55:47.994Z\"}}], \"cna\": {\"title\": \"Certificate Validation Bypass in VPN Site-to-Site Connections Using IKEv1\", \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.4, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"checkpoint\", \"product\": \"Quantum Security Gateway\", \"versions\": [{\"status\": \"affected\", \"version\": \"R82.10 with Jumbo Hotfix Take 19 or below\"}, {\"status\": \"affected\", \"version\": \"R82 with Jumbo Hotfix Take 103 or below\"}, {\"status\": \"affected\", \"version\": \"R81.20 with Jumbo Hotfix Take 141 or below\"}, {\"status\": \"affected\", \"version\": \"R81.10, R81, and R80.40\"}]}, {\"vendor\": \"checkpoint\", \"product\": \"Spark Firewalls\", \"versions\": [{\"status\": \"affected\", \"version\": \"R80.20.X, R81.10.X, and R82.00.X\"}]}], \"references\": [{\"url\": \"https://support.checkpoint.com/results/sk/sk185035\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"A weakness in the certificate validation logic of the deprecated IKEv1 key exchange may allow an unauthenticated attacker positioned as a man-in-the-middle to bypass certificate validation in VPN site-to-site connections that use certificate-based authentication. Successful exploitation could allow interception or modification of traffic traversing the VPN tunnel.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-295\", \"description\": \"CWE-295: Improper Certificate Validation.\"}]}], \"providerMetadata\": {\"orgId\": \"897c38be-0345-43cd-b6cf-fe179e0c4f45\", \"shortName\": \"checkpoint\", \"dateUpdated\": \"2026-06-08T11:00:38.563Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-50752\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-06-10T13:36:24.946Z\", \"dateReserved\": \"2026-06-07T09:42:08.252Z\", \"assignerOrgId\": \"897c38be-0345-43cd-b6cf-fe179e0c4f45\", \"datePublished\": \"2026-06-08T11:00:38.563Z\", \"assignerShortName\": \"checkpoint\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

CERTFR-2026-AVI-0711

Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans les VPN Check Point. Elles permettent à un attaquant de provoquer un contournement de la politique de sécurité.

Check Point indique que la vulnérabilité CVE-2026-50751 est activement exploitée.

La vulnérabilité CVE-2026-50751 affecte les instances avec le protocole IKEv1 activé.

L'éditeur fournit également des mesures de contournement ainsi que des indicateurs de compromission. Ceux-ci n'ont pas été qualifiés par le CERT-FR.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

L'éditeur précise que les versions R80.40, R81 et R81.10 de Security Gateways ainsi que les versions R80.20.X des pare-feux Spark sont en fin de vie et ne recevront donc pas de correctif.

Impacted products

Vendor	Product	Description
Check Point	Security Gateways	Security Gateways version R81
Check Point	Security Gateways	Security Gateways version R81.10
Check Point	Security Gateways	Security Gateways version R80.40
Check Point	Security Gateways	Security Gateways versions R82.10 et antérieures sans les derniers correctifs de sécurité, se référer aux bulletins de sécurité de l'éditeur (cf. section Documentation)
Check Point	Spark Firewalls	les pare-feux Spark versions R82.00.10 et antérieures sans les derniers correctifs de sécurité, se référer aux bulletins de sécurité de l'éditeur (cf. section Documentation)
Check Point	Security Gateways	Security Gateways versions R81.20 et antérieures sans les derniers correctifs de sécurité, se référer aux bulletins de sécurité de l'éditeur (cf. section Documentation)
Check Point	Security Gateways	Security Gateways versions R82 et antérieures sans les derniers correctifs de sécurité, se référer aux bulletins de sécurité de l'éditeur (cf. section Documentation)
Check Point	Spark Firewalls	les pare-feux Spark versions R80.20.X
Check Point	Spark Firewalls	les pare-feux Spark versions R81.10.17 et antérieures sans les derniers correctifs de sécurité, se référer aux bulletins de sécurité de l'éditeur (cf. section Documentation)

References

Title

Publication Time

Tags

Bulletin de sécurité Check Point sk185033	2026-06-08	vendor-advisory
Bulletin de sécurité Check Point sk185035	2026-06-08	vendor-advisory
Billet de blogue Check Point	-	other

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Security Gateways version R81",
      "product": {
        "name": "Security Gateways",
        "vendor": {
          "name": "Check Point",
          "scada": false
        }
      }
    },
    {
      "description": "Security Gateways version R81.10",
      "product": {
        "name": "Security Gateways",
        "vendor": {
          "name": "Check Point",
          "scada": false
        }
      }
    },
    {
      "description": "Security Gateways version R80.40",
      "product": {
        "name": "Security Gateways",
        "vendor": {
          "name": "Check Point",
          "scada": false
        }
      }
    },
    {
      "description": "Security Gateways versions R82.10 et ant\u00e9rieures sans les derniers correctifs de s\u00e9curit\u00e9, se r\u00e9f\u00e9rer aux bulletins de s\u00e9curit\u00e9 de l\u0027\u00e9diteur (cf. section Documentation)",
      "product": {
        "name": "Security Gateways",
        "vendor": {
          "name": "Check Point",
          "scada": false
        }
      }
    },
    {
      "description": "les pare-feux Spark versions R82.00.10 et ant\u00e9rieures sans les derniers correctifs de s\u00e9curit\u00e9, se r\u00e9f\u00e9rer aux bulletins de s\u00e9curit\u00e9 de l\u0027\u00e9diteur (cf. section Documentation)",
      "product": {
        "name": "Spark Firewalls",
        "vendor": {
          "name": "Check Point",
          "scada": false
        }
      }
    },
    {
      "description": "Security Gateways versions R81.20 et ant\u00e9rieures sans les derniers correctifs de s\u00e9curit\u00e9, se r\u00e9f\u00e9rer aux bulletins de s\u00e9curit\u00e9 de l\u0027\u00e9diteur (cf. section Documentation)",
      "product": {
        "name": "Security Gateways",
        "vendor": {
          "name": "Check Point",
          "scada": false
        }
      }
    },
    {
      "description": "Security Gateways versions R82 et ant\u00e9rieures sans les derniers correctifs de s\u00e9curit\u00e9, se r\u00e9f\u00e9rer aux bulletins de s\u00e9curit\u00e9 de l\u0027\u00e9diteur (cf. section Documentation)",
      "product": {
        "name": "Security Gateways",
        "vendor": {
          "name": "Check Point",
          "scada": false
        }
      }
    },
    {
      "description": "les pare-feux Spark versions R80.20.X",
      "product": {
        "name": "Spark Firewalls",
        "vendor": {
          "name": "Check Point",
          "scada": false
        }
      }
    },
    {
      "description": "les pare-feux Spark versions R81.10.17 et ant\u00e9rieures sans les derniers correctifs de s\u00e9curit\u00e9, se r\u00e9f\u00e9rer aux bulletins de s\u00e9curit\u00e9 de l\u0027\u00e9diteur (cf. section Documentation)",
      "product": {
        "name": "Spark Firewalls",
        "vendor": {
          "name": "Check Point",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "L\u0027\u00e9diteur pr\u00e9cise que les versions R80.40, R81 et R81.10 de Security Gateways ainsi que les versions R80.20.X des pare-feux Spark sont en fin de vie et ne recevront donc pas de correctif.",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2026-50752",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-50752"
    },
    {
      "name": "CVE-2026-50751",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-50751"
    }
  ],
  "initial_release_date": "2026-06-09T00:00:00",
  "last_revision_date": "2026-06-09T00:00:00",
  "links": [
    {
      "title": "Billet de blogue Check Point",
      "url": "https://blog.checkpoint.com/security/check-point-releases-important-hotfix-for-vulnerabilities-in-deprecated-ikev1-vpn-protocol/"
    }
  ],
  "reference": "CERTFR-2026-AVI-0711",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2026-06-09T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les VPN Check Point. Elles permettent \u00e0 un attaquant de provoquer un contournement de la politique de s\u00e9curit\u00e9.\n\nCheck Point indique que la vuln\u00e9rabilit\u00e9 CVE-2026-50751 est activement exploit\u00e9e.\n\nLa vuln\u00e9rabilit\u00e9 CVE-2026-50751 affecte les instances avec le protocole IKEv1 activ\u00e9.\n\nL\u0027\u00e9diteur fournit \u00e9galement des mesures de contournement ainsi que des indicateurs de compromission. Ceux-ci n\u0027ont pas \u00e9t\u00e9 qualifi\u00e9s par le CERT-FR.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les VPN Check Point",
  "vendor_advisories": [
    {
      "published_at": "2026-06-08",
      "title": "Bulletin de s\u00e9curit\u00e9 Check Point sk185033",
      "url": "https://support.checkpoint.com/results/sk/sk185033"
    },
    {
      "published_at": "2026-06-08",
      "title": "Bulletin de s\u00e9curit\u00e9 Check Point sk185035",
      "url": "https://support.checkpoint.com/results/sk/sk185035"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

CVE-2026-50752 (GCVE-0-2026-50752)

Vulnerability from cvelistv5

CERTFR-2026-AVI-0711

Vulnerability from certfr_avis

Solutions

Tags

Sightings

Nomenclature