HIGH Actively exploited Used in ransomware CWE-200
CVE-2024-24919
Information disclosure
Check Point·Quantum Security Gateways
8.6/ 10
CVSS 3.1
High severity
>99.9%
EPSS exploit odds
Chance of exploitation in the next 30 days
Among the very highest of all CVEs
Listed
CISA KEV catalog
- Added
- May 30, 2024
- Fix due
- Jun 20, 2024
- Ransomware
- Known use
Timeline
- Published
- May 28, 2024
- Updated
- Aug 5, 2026
- First covered
- Jul 23, 2026
- Latest story
- 4 months ago
Summary
Potentially allowing an attacker to read certain information on Check Point Security Gateways once connected to the internet and enabled with remote Access VPN or Mobile Access Software Blades. A Security fix that mitigates this vulnerability is available.
CWE-200Exposure of Sensitive Information to an Unauthorized Actor
Attack profile
Attack vectorNetwork
ComplexityLow
PrivilegesNone
User interactionNone
ScopeChanged
ConfidentialityHigh
IntegrityNone
AvailabilityNone
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:NCISA required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Affected products
- Check Point Quantum Gateway, Spark Gateway and CloudGuard NetworkCheck Point Quantum Gateway and CloudGuard Network versions R81.20, R81.10, R81, R80.40 and Check Point Spark versions R81.10, R80.20.