CVE Web Check

An approval-based local webapp for scanning and remediating potential Check Point CVE-2026-50751 and CVE-2026-50752 exposure with trusted Check Point Management API commands.

This tool is not created or supported by Check Point and should be used at your own risk. Remediation is temporary. Check Point recommends patching quickly using the patches provided for each CVE in the Check Point Security Advisories.

The app runs locally, logs in to a Check Point Security Management Server or MDS, scans relevant VPN configuration, shows exactly where remediation may be needed, lets an operator approve the changes, applies the changes through the Management API, and can publish the management session. Policy still needs to be installed after publishing for the remediation changes to take effect on gateways.

What It Checks

IKE Version Global Property Scan and Remediate (CVE-2026-50751)

Scans the SMS global Remote Access VPN property:

remote-access.vpn-authentication-and-encryption.encryption-method

If the current value is not ike_v2_only, the app can approve and apply a change to set the property to:

ike_v2_only

This scan is intended to identify exposure where deprecated IKEv1 key exchange is still globally allowed for VPN Remote Access and Mobile Access. IKEv1 is deprecated and no longer industry best practice. This change can affect older VPN clients. Review SK166415 for additional Check Point guidance.

Legacy Client's Allowed Check Scan and Remediate (CVE-2026-50751)

Scans simple gateways and checks each gateway generic object for the VPN realm inside:

realmsForBlades

The app reports whether legacy clients are supported or disabled. When remediation is approved, it sets the VPN realm owned-object disabled value to true.

User-facing result text:

• Legacy clients are disabled
• Legacy Clients are Supported

Allowing legacy clients can preserve support for IKEv1, which is no longer an industry best practice. We recommend disabling this setting unless legacy clients are still required. If legacy clients are needed, plan to migrate them to a more secure modern VPN client.

Site-to-Site VPN Communities Scan and Remediate (CVE-2026-50752)

Scans both Check Point site-to-site VPN community types:

• Star communities
• Mesh communities

The app flags a VPN community only when all of these are observed:

• VPN site-to-site is enabled.
• The VPN community uses IKEv1.
• Gateways participating in the VPN community use certificate-based authentication.

For Star communities, the app displays center gateways and satellite gateways separately. Gateway names are tagged as locally managed or externally managed when the API data provides enough object type information.

For Mesh communities, the app pulls gateway names from the community gateways list. Mesh communities do not include externally managed gateway handling in this tool, so that field is shown as not applicable.

When remediation is approved, the app attempts to set the VPN community encryption method to IKEv2 only. Star communities use:

set-vpn-community-star

Mesh communities use:

set-vpn-community-meshed

If a selected Star community includes externally managed gateways, the app warns before applying the change. You must make sure the matching IKEv2-only change is also made on the externally managed gateway side.

Workflow

1. Log in with a Check Point Management API user.
2. Click Scan Check Point Config.
3. Review the SMS global property, legacy client gateway findings, and site-to-site VPN community findings.
4. Approve only the changes you want to apply.
5. Click the matching apply button.
6. Publish from the tool or uncheck Publish after successful apply if you want to inspect and publish manually.
7. Install policy after publishing so gateway-side changes take effect.

Security Notes

• The app defaults to HTTPS when connecting to the Check Point management server.
• Do not enter the management server as http://...; that would send the Check Point API login over cleartext HTTP.
• The browser talks to the local backend over http://127.0.0.1:3000.
• The username and password are sent from the browser to the local backend only on localhost.
• The backend sends the username and password to Check Point through the Management API login request.
• Passwords are not logged by the app.
• The Check Point session ID is stored only in server memory for the life of the local Node process.
• The Allow self-signed certificate option keeps TLS encryption but disables certificate validation. Use it only when needed.

API Commands Used

The backend proxies these Check Point Management API commands:

• login
• logout
• publish
• show-simple-gateways
• show-generic-object
• set-generic-object
• show-global-properties
• set-global-properties
• show-vpn-communities-star
• show-vpn-communities-meshed
• set-vpn-community-star
• set-vpn-community-meshed

Install and Run

This project has no third-party npm dependencies. It only requires Node.js 18 or newer when running from source.

macOS From Source

1. Install Node.js 18 or newer from nodejs.org or Homebrew.

   root@kitploit:~

   brew install node
   

2. Download or clone this project.

   root@kitploit:~

   git clone <repo-url>
   cd CVE-Web-Check
   

3. Start the local app.

   root@kitploit:~

   npm start
   

   Because there are no npm dependencies, this also works:

   root@kitploit:~

   node server.js
   

4. Open the app.

   root@kitploit:~

   http://127.0.0.1:3000
   

Windows From Source

1. Install Node.js 18 or newer from nodejs.org.

2. Download and extract the project ZIP, or clone the repository with Git for Windows.

   root@kitploit:~

   git clone <repo-url>
   cd CVE-Web-Check
   

3. Start the local app.

   root@kitploit:~

   npm start
   

   Because there are no npm dependencies, this also works:

   root@kitploit:~

   node server.js
   

4. Open the app in a browser.

   root@kitploit:~

   http://127.0.0.1:3000
   

Optional Port Change

By default the app listens on 127.0.0.1:3000. To use another port:

macOS:

PORT=3100 npm start

Windows PowerShell:

$env:PORT = "3100"
npm start

Then open:

http://127.0.0.1:3100

Troubleshooting

The server prints request diagnostics to the terminal. A successful login attempt will show lines similar to:

Local API request requestId=abc12345 route=/api/login
Login request received target=https://mgmt.example.com/web_api/login user=admin
Check Point API request starting command=login target=https://mgmt.example.com/web_api/login

If the browser shows a login error with a request ID but packet capture shows no outbound attempt to the management server, compare the terminal target= value with your packet capture filter.

If there is no Local API request line at all, the browser is not reaching the local backend. Confirm the app is running and that you opened the correct local URL.