Loading story…
Check Point disclosed and patched CVE-2024-24919, a critical information disclosure flaw affecting Internet-connected Network Security Gateway devices with Remote Access VPN or Mobile Access enabled. The vulnerability was traced to improper HTTP POST request validation that can enable directory traversal and arbitrary file reads by an unauthenticated attacker, allowing exposure of sensitive data from affected gateways. Check Point said it observed exploitation attempts in the wild, issued an initial mitigation, then released a mandatory hotfix and urged customers to apply it immediately.
Reported abuse focused on remote-access environments, particularly older local VPN accounts using password-only authentication. Stolen data may include local account password hashes, private SSH keys, certificates, and potentially Active Directory-related files such as ntds.dit, creating follow-on risk of credential theft, lateral movement, broader network intrusion, and possible escalation toward remote code execution. Check Point and external responders advised organizations to disable unused local accounts, enforce stronger authentication such as MFA or certificates, rotate exposed credentials, and review gateway and authentication logs for signs of compromise.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Check Point published guidance describing observed exploitation focused on remote-access scenarios using old local VPN accounts with password-only authentication, and said it was working with customers believed to be affected. It advised disabling unused local accounts and strengthening authentication, such as using certificates instead of password-only logins.
Check Point stated that it identified the root cause of CVE-2024-24919 and released a mandatory fix. The company also said it had observed exploitation attempts against a small number of customers.
Check Point said it delivered an initial mitigation for the VPN information disclosure vulnerability affecting Internet-connected Network Security gateways with Remote Access VPN or Mobile Access enabled.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
csirt.sk
Open sourceblog.checkpoint.com
Open sourcelabs.watchtowr.com
Open sourcesupport.checkpoint.com
Open sourcemnemonic.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Check Point disclosed that its remote access VPN solutions had been targeted in ongoing attacks and later confirmed the activity was tied to **CVE-2024-24919**, a vulnerability affecting multiple **Quantum Gateway** product lines. The flaw can allow unauthorized reading of certain firewall device information when **VPN** or **Mobile Access** functionality is enabled, and early observed exploitation involved older local accounts that still used password-only authentication. Check Point released a hotfix after updating its advisory, but external researchers said the issue was more severe than first described, that exploitation was relatively simple, and that a proof-of-concept had been published. Reporting indicated exploitation may have been underway since at least 30 April 2024, prompting urgent guidance for organizations to patch exposed devices immediately, review whether internet-facing systems had already been compromised, and follow Check Point validation and remediation guidance.
Jun 29, 2026
Check Point disclosed **`CVE-2026-16232`**, a high-severity SmartConsole authentication bypass affecting **Security Management**, **Multi-Domain Management**, **Firewall**, and **Multi-Domain Log Server** products across multiple versions. The flaw, rated **CVSS 9.3**, allows attackers to bypass SmartConsole login using an application token, and Check Point said it has already been exploited against a small number of customers with specific exposed configurations. Check Point released fixes for `CVE-2026-16232` along with related flaws **`CVE-2026-62144`** and **`CVE-2026-62145`**, while the Canadian Centre for Cyber Security issued advisory **AV26-735** urging organizations to review the vendor guidance and apply mitigations. The highest risk is for management interfaces exposed directly to the internet without IP restrictions, and defenders were advised to install the available jumbo hotfix, restrict trusted GUI clients by IP address, and place management access behind a firewall until patching is complete.
Jul 30, 2026
Check Point released security updates to fix multiple vulnerabilities across **Mobile Access**, **SSL VPN**, **Remote Access VPN**, **Spark Firewall**, **Security Gateways**, and **Multi-Domain Security Management**. The most severe flaw, **`CVE-2026-50751`** with a **CVSS 9.3**, is an authentication bypass issue in deprecated **IKEv1** key exchange used for VPN Remote Access and Mobile Access, and Check Point said it is being exploited in the wild as a **zero-day**. The update also addresses **`CVE-2026-50752`**, which affects certificate validation in deprecated **IKEv1** site-to-site VPN connections and could allow **man-in-the-middle** attacks. Across the broader set of flaws, Check Point warned of risks including **denial of service, data manipulation, authentication bypass, and unauthorized access**, and urged organizations to apply patches as soon as testing is complete.
Jul 10, 2026