Check Point warns of Management Server zero-day exploited in attacks
Check Point patched CVE-2026-93616, an exploited unauthenticated Management Server zero-day.
84
CVE-2024-24919
Information Disclosure in Internet-Facing Check Point Quantum Security Gateways
CISA: Check Point Quantum Security Gateways Information Disclosure Vulnerability
- CVSS 3.1
- 8.6 high
- EPSS
- 100%p100
- Published
- ·
- Added to KEV
AI analysisSummaries by Vani AI
Check Point Quantum Security Gateways contain an information disclosure flaw (CWE-200) that can expose information stored on the appliance to unauthorized parties. It is triggered when an attacker targets a gateway connected to the internet with IPSec VPN, Remote Access VPN, or Mobile Access enabled, sending crafted requests to the exposed VPN services. A successful attacker gains unauthorized access to information on the gateway, and CISA notes known use of this flaw in ransomware campaigns. The issue spans multiple Check Point product lines: CloudGuard Network, Quantum Scalable Chassis, Quantum Security Gateways, and Quantum Spark Appliances. Exploitation is confirmed in the wild: the flaw was added to CISA's KEV catalog on 2024-05-30 with ransomware use listed, and EPSS assigns a 100% probability of exploitation within 30 days, though no public proof-of-concept is known.
What to do: Apply the hotfix Check Point distributes per its advisory (SK170863) to all internet-facing gateways running IPSec VPN, Remote Access VPN, or Mobile Access; this is also the CISA KEV required action. Where the hotfix cannot be applied immediately, restrict or disable the Remote Access VPN and Mobile Access software blades as an interim mitigation. Review gateway and VPN logs for signs of exploitation and prioritize remediation given confirmed ransomware use.
| Product | Affected |
|---|---|
| Check Point Quantum Security Gateways | — |
| Check Point CloudGuard Network | — |
| Check Point Quantum Scalable Chassis | — |
| Check Point Quantum Spark Appliances | — |
Estimated exposure
largetens of thousands of internet-exposed VPN gateways (10k-100k systems) — Check Point is one of the most widely deployed enterprise edge firewall/VPN vendors, and public internet scans routinely surface tens of thousands of Check Point gateways; only internet-facing gateways with remote-access VPN blades enabled…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Potentially allowing an attacker to read certain information on Check Point Security Gateways once connected to the internet and enabled with remote Access VPN or Mobile Access Software Blades. A Security fix that mitigates this vulnerability is available.
KEVCISA Known Exploited Vulnerability
- Affected
- Check Point Quantum Security Gateways
- Required action
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Due date
- Ransomware use
- Known
- Vendors
- checkpoint
- Products
- quantum spark firmware, quantum security gateway firmware, cloudguard network security
- Weakness
- CWE-200
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
In the news
16 storiesFBI Disrupts China-Linked QTFY Infrastructure Used to Steal Data From U.S. Organizations
FBI and Lumen disrupted QTFY's QScan and QTRouter botnet platforms used by Chinese state-sponsored hackers to conceal intrusions into U.S. agencies.
78
60
60
60
60
60
60
60
60
60
Week in review: Attackers trying to access Check Point VPNs, NIST CSF 2.0 security metrics evolution
60
60
60
60
60