CVE-2026-50752

CVE Enrichment

CVSS: 7.4 HIGH
EPSS: 5.01%
EPSS Percentile: 92.24%
CISA KEV: Not listed

Description

A weakness in the certificate validation logic of the deprecated IKEv1 key exchange may allow an unauthenticated attacker positioned as a man-in-the-middle to bypass certificate validation in VPN site-to-site connections that use certificate-based authentication. Successful exploitation could allow interception or modification of traffic traversing the VPN tunnel.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: [email protected]
Published: 08-Jun-2026 19:16
Last Modified: 23-Jul-2026 14:10
EPSS Date: 2026-10-31
CWE: CWE-295

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:H /
                            PR:N /
                            UI:N /
                            S:U /
                            C:H /
                            I:H /
                            A:N

References

[email protected]

Last enrichment sync: 31-Oct-2026 22:19
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (3)

Tracked as CVE-2026-50752, it allows attackers to mount man-in-the-middle attacks on VPN site-to-site connections, but has not been exploited in the wild. Check Point VPN Zero-Day Exploited in Attacks, One Linked to Qilin
globally and has been linked in one case to a Qilin ransomware affiliate, while a separate issue, CVE-2026-50752, could enable AitM attacks on site-to-site VPN connections. Check Point Warns of Active Exploitation of IKEv1 VPN Authentication Flaw
The company also discovered CVE-2026-50752, a related IKEv1 certificate validation issue that could enable man-in-the-middle attacks on site-to-site VPN connections. Check Point Patches Exploited VPN Zero-Day Linked to Qilin Affiliate

CVE (1)

Malware (1)

Threat Actors (1)

MITRE ATT&CK (4)

Vendors (1)

Products (4)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.