CVE-2026-50751-Mitigation-Scripts

There are multiple mitigation techniques you can use from the sk; https://support.checkpoint.com/results/sk/sk185033

1. Disable legacy client support.
2. Configure Remote Access to only use ike v2

There are scripts for both of those changes; Please read https://support.checkpoint.com/results/sk/sk166415 to understand supported ikev2 Clients

SMS

If you want to do 1 and disable legacy clients download disable_legacy_clients.SMS.sh and run it from the command line of of your manager. Be sure to chmod +x disable_legacy_clients.SMS.sh to make it executible. PLEASE NOTE THIS USES GENERIC OBJECTS AND CARRIES THE SAME RISK AS DBEDIT

If you want to simply switch to ike v2 then you can run this simple one line command to do that; mgmt_cli -r true set global-properties remote-access.vpn-authentication-and-encryption.encryption-method “ike_v2_only"

MDS

This script is intended for Check Point Multi-Domain Security Management environments. It loops through each configured Domain on an MDS server and updates either the legacy client or the ikev v2 change like the SMS above.

Purpose

Again, there are two scripts;

1. disable_legacy_clients_MDS.sh will disable the legacy client check box on each gateway object on each domain in your MDS. It loops through them all at once so it may take a bit. Again... PLEASE NOTE THIS USES GENERIC OBJECTS AND CARRIES THE SAME RISK AS DBEDIT
2. switch_ikev2_mds.sh The script applies the following Management API change in each Domain: mgmt_cli -r true set global-properties remote-access.vpn-authentication-and-encryption.encryption-method "ike_v2_only"

Requirements

Run from the MDS management server Check Point Management API enabled mgmt_cli must be available in the shell Script should be run by an administrator familiar with MDS environments Make sure you use "chmod +x script_name.sh" to make the script executible. Execute with ./script_name.sh.sh

Important Notes

This script publishes changes automatically using -r true. A policy install is still required on affected gateways for the change to take effect. Test in a lab or maintenance window before running in production. Please read https://support.checkpoint.com/results/sk/sk166415 to understand supported ikev2 Clients

Review the Domain list before applying changes broadly. Example Command Used Per Domain mgmt_cli -r true -d "<DOMAIN_NAME>" set global-properties remote-access.vpn-authentication-and-encryption.encryption-method "ike_v2_only" Post-Change Verification

You can verify the value in a Domain with:

mgmt_cli -r true -d "<DOMAIN_NAME>" show global-properties details-level full --format json | jq '.["remote-access"]["vpn-authentication-and-encryption"]["encryption-method"]'

Expected result:

"ike_v2_only"

Disclaimer

Use at your own risk. Always validate the command syntax against your specific Check Point version and Management API schema before running in production.