Detect Check Point Security Gateway Improper Authentication (CVE-2026-50751) in Microsoft Sentinel
Detects exploitation of CVE-2026-50751, an improper authentication vulnerability (CWE-287) in Check Point Security Gateway affecting deprecated IKEv1 VPN protocol. This vulnerability is actively exploited in the wild (CISA KEV) and may allow unauthenticated attackers to bypass authentication controls on the VPN gateway. Detection focuses on anomalous IKEv1 negotiation patterns, authentication bypass indicators, and suspicious gateway access following failed or malformed IKE exchanges.
MITRE ATT&CK
- Tactic
- Initial Access Credential Access
KQL Detection Query
let timeWindow = 1h;
let suspiciousIKE = CommonSecurityLog
| where TimeGenerated > ago(timeWindow)
| where DeviceVendor == "Check Point"
| where Activity has_any ("IKE", "VPN", "IPSec")
| where Message has_any ("IKEv1", "ikev1", "phase1", "aggressive mode")
| where Message has_any ("auth", "authentication", "identity", "failed", "bypass", "invalid")
| project TimeGenerated, DeviceAction, SourceIP, DestinationIP, Message, Activity, DeviceName;
let authAnomalies = CommonSecurityLog
| where TimeGenerated > ago(timeWindow)
| where DeviceVendor == "Check Point"
| where Activity has "VPN"
| where DeviceAction in ("Accept", "Allow")
| where Message has_any ("unauthenticated", "no credentials", "pre-shared", "certificate")
| project TimeGenerated, SourceIP, DestinationIP, DeviceAction, Message, DeviceName;
union suspiciousIKE, authAnomalies
| summarize EventCount=count(), Messages=make_set(Message, 10), Actions=make_set(DeviceAction) by SourceIP, DeviceName, bin(TimeGenerated, 5m)
| where EventCount > 2
| extend RiskScore = case(EventCount > 20, "High", EventCount > 5, "Medium", "Low")
| order by EventCount descDetects anomalous IKEv1 authentication patterns on Check Point Security Gateways that may indicate exploitation of CVE-2026-50751. Correlates IKEv1 negotiation events with authentication anomalies from the same source.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate IKEv1 VPN clients connecting to gateway before hotfix disables deprecated protocol
- Network scanning tools performing VPN fingerprinting in authorized penetration tests
- Legacy VPN clients that have not been updated and still negotiate IKEv1
Other platforms for CVE-2026-50751
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1IKEv1 Aggressive Mode Probe — Check Point Gateway
Expected signal: Check Point SmartLog IKE phase 1 event with protocol IKEv1, mode aggressive, from the test host IP. UDP/500 connection event in network logs.
- Test 2Repeated IKEv1 Auth Failure Simulation
Expected signal: 10 IKEv1 negotiation attempts with authentication failure events in SmartLog. Source IP flagged in Check Point IPS/firewall blade logs.
- Test 3IKEv1 vs IKEv2 Protocol Downgrade Attempt
Expected signal: StrongSwan IKEv1 initiation attempt visible in system logs; Check Point gateway logs showing inbound IKEv1 proposal from test host on UDP/500.
Unlock Pro Content
Get the full detection package for CVE-2026-50751 including response playbook, investigation guide, and atomic red team tests.