CVE-2024-24919
Potentially allowing an attacker to read certain information on Check Point Security Gateways once connected to the internet and enabled with remote Access VPN or Mobile Access Software Blades. A Security fix that mitigates this vulnerability is available.
Actively exploited
- In the CISA exploited-vulnerabilities catalogue since May 30, 2024
- US federal agencies must remediate it by Jun 20, 2024 (BOD 22-01)
- Attacked 2 days before the vulnerability was made public
- Confirmed by sensors, not only by reports
- Used in ransomware campaigns
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Source: CISA KEV · Oct 22, 2026 Oct 21, 2026 Oct 20, 2026 Oct 19, 2026 Oct 7, 2026 Oct 3, 2026
CVSS score8.6 / 10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:NWeakness type (CWE)CWE-200
Vendorscheckpoint
Affected products
| Vendors | Product | Versions |
|---|---|---|
| checkpoint | quantum spark firmware | r80.40 |
| checkpoint | quantum spark | - |
| checkpoint | quantum security gateway firmware | r80.40 |
| checkpoint | quantum security gateway | - |
| checkpoint | cloudguard network security | r80.40 |
Related articles
This product uses the NVD API but is not endorsed or certified by the NVD.