CVE-2024-24919

Confirmed PUBLISHED

Information disclosure

Vendor: checkpoint Product: Check Point Quantum Gateway, Spark Gateway and CloudGuard Network

Exploited in the wild Active exploitation observed Used in malware PoC available

Recommended Action

Prioritize immediate patching and validate internet-facing exposure. Monitor for matching exploitation attempts in your environment.

View KEV Feed Talk to Sales

Confidence

Confirmed

Exploitation Status

Active exploitation observed

Observed in Sensors

Yes

Attempts (30d)

Unique Attacker IPs

CISA KEV

In CISA KEV

CVSS / EPSS

8.6 High EPSS 100.0%

At a Glance

Potentially allowing an attacker to read certain information on Check Point Security Gateways once connected to the internet and enabled with remote Access VPN or Mobile Access Software Blades. A Security fix that mitigates this vulnerability is available.

malware cisa nessus_scanner windows ransomware nuclei_scanner qilin ransomware

CVE Published: May 28, 2024
Exploitation Reported: May 30, 2024
CVSS: 8.6 High
EPSS: 100.0%

Remote Low complexity No user interaction Unauthenticated

Sensor telemetry available

Affected Versions

49 version rows · page 1 of 2

Vendor	Product	Version	Status
checkpoint	quantum_security_gateway_firmware	r80.40	Affected
checkpoint	quantum_security_gateway_firmware	r81	Affected
checkpoint	quantum_security_gateway_firmware	r81.10	Affected
checkpoint	quantum_security_gateway_firmware	r81.20	Affected
checkpoint	quantum_security_gateway_firmware	r80.40	Affected
checkpoint	quantum_security_gateway_firmware	r81	Affected
checkpoint	quantum_security_gateway_firmware	r81.10	Affected
checkpoint	quantum_security_gateway_firmware	r81.20	Affected
checkpoint	quantum_security_gateway_firmware	r80.40	Affected
checkpoint	quantum_security_gateway_firmware	r81	Affected
checkpoint	quantum_security_gateway_firmware	r81.10	Affected
checkpoint	quantum_security_gateway_firmware	r81.20	Affected
checkpoint	quantum_security_gateway_firmware	r80.40	Affected
checkpoint	quantum_security_gateway_firmware	r81	Affected
checkpoint	quantum_security_gateway_firmware	r81.10	Affected
checkpoint	quantum_security_gateway_firmware	r81.20	Affected
checkpoint	cloudguard_network	r80.40	Affected
checkpoint	cloudguard_network	r81	Affected
checkpoint	cloudguard_network	r81.10	Affected
checkpoint	cloudguard_network	r81.20	Affected
checkpoint	cloudguard_network	r80.40	Affected
checkpoint	cloudguard_network	r81	Affected
checkpoint	cloudguard_network	r81.10	Affected
checkpoint	cloudguard_network	r81.20	Affected
checkpoint	cloudguard_network	r80.40	Affected

CVE References

support.checkpoint.com/results/sk/sk182336 support.checkpoint.com · CVE Record https://support.checkpoint.com/results/sk/sk182336

Known Exploited Vulnerability Sources

Catalogues that list this CVE as a known exploited vulnerability.

Per-source evidence links for KEV attestations are available through the KEVIntel Pro API.

Learn about Pro API access

Source	Added
CISA First	2024-05-30 00:00 UTC
The Shadowserver	2026-05-31 00:00 UTC
Rapid7	2026-06-08 19:21 UTC
KEVIntel	2026-07-22 08:55 UTC

Operational indicators for this CVE are listed on the Detection tab.

Indicators of Compromise (IoCs)

Attacker IP IoCs observed in KEVIntel sensors are available to Pro and Enterprise accounts on the Detection tab and through the Pro API.

Learn about Pro API access

Observed Detection Signals (30d)

Aggregate counts from KEVIntel sensor telemetry for this CVE.

Distinct request paths: 1
Distinct User-Agents: 11

The specific request paths and User-Agents attackers are using are available on Pro and Enterprise plans.

Request Enterprise Access Compare plans Create free account

Scanner Artifacts

Scanner and exploit-framework references linked to this CVE.

Scanner	Reference	Detected
Nuclei	https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-24919.yaml	Apr 25, 2025
Nessus	https://www.tenable.com/plugins/nessus/198147	May 30, 2024

CVSS Scores

CVSS v3.1 8.6 High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Exploitation Status

Exploited in the wild

Recorded 2024-05-30 00:00:00 UTC · CISA

Active exploitation observed

Recorded 2026-06-27 10:06:01 UTC · KEVIntel sensor

Used in qilin ransomware malware

Recorded 2024-05-30 00:00:00 UTC · CISA

Proof of concept available

Recorded 2024-05-31 10:18:36 UTC · GitHub

Weaknesses (CWE)

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

Scanner Integrations

Nuclei, Metasploit, and other scanner references for this CVE are listed on the Detection tab.

Recent Mentions

CVE-2026-16232: Critical Check Point SmartConsole Authentication Bypass Exploited in the Wild

Rapid7 · Jul 23, 2026

OverviewOn July 22, 2026, Check Point published a security advisory for multiple vulnerabilities affecting Security Management, Multi-Domain Management, and firewall products. The most urgent of these is CVE-2026-16232, an authentication bypass in the SmartConsole login process classified as improper authentication (CWE-287). CVE-2026-16232 has been assigned a critical CVSS score of 9.1. The vulnerability allows an unauthenticated remote attacker to obtain an application login token and authenticate to the management server with full administrative privileges, enabling modification of security policies and configurations.Check Point has confirmed that CVE-2026-16232 is being actively exploited in the wild, affecting what the vendor describes as a small number of customers. Remote exploitation requires network access to the Management Server IP address in environments that do not restrict Trusted Clients. On the same day as the advisory, CVE-2026-16232 was added to the U.S. Cybersecurity and Infrastructure Security Agency's (CISA) list of known exploited vulnerabilities (KEV), with a remediation due date of July 25, 2026, giving organizations only three days to respond.The advisory addresses three vulnerabilities in total:CVECVSSDescriptionAffected ProductsExploitation StatusCVE-2026-16232Vendor: 9.3 (Critical)CISA: 9.1 (Critical)Authentication bypass via SmartConsole application tokenSecurity Management, Multi-Domain ManagementExploited in the wildCVE-2026-62144Vendor: 9.3 (Critical)CISA: 9.1 (Critical)Management authentication bypass and privilege escalationSecurity Management, Multi-Domain ManagementNo known exploitationCVE-2026-621457.5 (High)Local privilege escalation in GaiaOS WebUIFirewall, Multi-Domain Management, Multi-Domain Log ServerNo known exploitationCompromise of a Security Management Server is particularly consequential because it sits at the top of the trust hierarchy. An attacker with administrative access can modify security policies across...

Critical Check Point VPN Zero-Day Exploited in the Wild (CVE-2026-50751)

Rapid7 · Jun 08, 2026

OverviewOn June 8, 2026, Check Point published a security advisory for CVE-2026-50751, a critical authentication bypass vulnerability affecting Check Point Remote Access VPN, Mobile Access, and Spark Firewall products. The vulnerability affects deployments configured to use the deprecated IKEv1 key exchange protocol where gateways accept legacy Remote Access clients and do not require a machine certificate for connections.CVE-2026-50751, classified as improper authentication (CWE-287), has a CVSS score of 9.3. The vulnerability stems from a logic flow weakness in how Remote Access and Mobile Access components validate certificates during IKEv1 key exchange; successful exploitation allows an unauthenticated attacker to establish a VPN session without providing valid credentials. Per the vendor, additional post-authentication activity is required to access internal resources or escalate privileges.Check Point has indicated that CVE-2026-50751 is being actively exploited in the wild, with observed activity dating back to May 7, 2026 and an increase in early June. The vendor characterizes the campaign as limited in scope, affecting several dozen organizations. At least one incident has been linked to a Qilin ransomware affiliate, which Check Point assesses with medium confidence. Rapid7 has observed at least one case with high confidence that can be attributed to CVE-2026-50751.Separately, during its investigation Check Point identified a related vulnerability, CVE-2026-50752 (CVSS 7.4), in the same IKEv1 code path that could enable a man-in-the-middle attack against site-to-site VPN tunnels under certain configurations. No exploitation of CVE-2026-50752 has been observed.Check Point VPN products have been targeted by zero-day vulnerabilities in the past. In May 2024, CVE-2024-24919, a high-severity information disclosure vulnerability in Check Point Quantum Security Gateways, was exploited in the wild and subsequently added to the CISA Known Exploited...

Potential Proof of Concepts

These PoCs are unverified and could contain malware. Use at your own risk.

geniuszly/CVE-2024-24919

github · Created 2024-09-29 08:20:56 UTC · 6 stars

PoC script for CVE-2024-24919 vulnerability. It scans a list of target URLs to identify security issues by sending HTTP POST requests and analyzing server responses

protonnegativo/CVE-2024-24919

github · Created 2024-06-10 01:29:19 UTC · 2 stars

Python script to automate the process of finding vulnerable sites for CVE-2024-24919.

verylazytech/CVE-2024-24919

github · Created 2024-06-09 06:54:51 UTC · 9 stars

POC - CVE-2024–24919 - Check Point Security Gateways

GuayoyoCyber/CVE-2024-24919

github · Created 2024-06-03 18:17:45 UTC · 5 stars

Nmap script to check vulnerability CVE-2024-24919

0nin0hanz0/CVE-2024-24919-PoC

github · Created 2024-06-03 13:30:31 UTC · 6 stars

Rug4lo/CVE-2024-24919-Exploit

github · Created 2024-06-03 12:18:35 UTC · 3 stars

CVE-2024-24919 Exploit and PoC - Critical LFI for Remote Access VPN or Mobile Access.

bigb0x/CVE-2024-24919-Sniper

github · Created 2024-06-02 20:16:22 UTC · 2 stars

CVE-2024-24919 Sniper - A powerful tool for scanning Check Point Security Gateway CVE-2024-24919 vulnerability. Supports single & bulk scanning, multithreading, and generates detailed CSV reports. Ideal for penetration testers and security researchers.

r4p3c4/CVE-2024-24919-Exploit-PoC-Checkpoint-Firewall-VPN

github · Created 2024-06-01 12:02:43 UTC · 2 stars

Herramienta de explotación para explotar la vulnerabilidad CVE-2024-24919 en las VPN de Checkpoint Firewall

ifconfig-me/CVE-2024-24919-Bulk-Scanner

github · Created 2024-06-01 10:51:14 UTC · 31 stars

CVE-2024-24919 [Check Point Security Gateway Information Disclosure]

un9nplayer/CVE-2024-24919

github · Created 2024-05-31 18:14:19 UTC · 16 stars

This repository contains a proof-of-concept (PoC) exploit for CVE-2024-24919, a critical vulnerability discovered in Check Point SVN. The vulnerability allows for reading system files. CVE ID: CVE-2024-24919

GlobalsecureAcademy/CVE-2024-24919

github · Created 2024-05-31 17:14:48 UTC · 3 stars

Exploit tool to validate CVE-2024-24919 vulnerability on Checkpoint Firewall VPNs

GoatSecurity/CVE-2024-24919

github · Created 2024-05-31 13:11:40 UTC · 17 stars

CVE-2024-24919 exploit

smackerdodi/CVE-2024-24919-nuclei-templater

github · Created 2024-05-31 12:33:34 UTC · 4 stars

Nuclei template for CVE-2024-24919

seed1337/CVE-2024-24919-POC

github · Created 2024-05-31 11:52:59 UTC · 49 stars

RevoltSecurities/CVE-2024-24919

github · Created 2024-05-31 10:18:36 UTC · 23 stars

An Vulnerability detection and Exploitation tool for CVE-2024-24919

zam89/CVE-2024-24919

github · Created 2024-05-31 07:59:17 UTC · 3 stars

Simple POC Python script that check & leverage Check Point CVE-2024-24919 vulnerability (Wrong Check Point)

Bytenull00/CVE-2024-24919

github · Created 2024-05-30 20:14:19 UTC · 3 stars

Quick and simple script that takes as input a file with multiple URLs to check for the CVE-2024-24919 vulnerability in CHECKPOINT

LucasKatashi/CVE-2024-24919

github · Created 2024-05-30 16:23:18 UTC · 13 stars

CVE-2024-24919 Exploit PoC

emanueldosreis/CVE-2024-24919

github · Created 2024-05-30 14:41:32 UTC · 5 stars

POC exploit for CVE-2024-24919 information leakage

c3rrberu5/CVE-2024-24919

github · Created 2024-05-30 07:55:53 UTC · 6 stars

Nuclei Template to discover CVE-2024-24919. A path traversal vulnerability in CheckPoint SSLVPN.

Check Point Quantum Gateway - Information Disclosure

nuclei · Created Unknown

Timeline

Key exploitation, disclosure, scanner coverage, and KEV attestation events for this CVE.

27 Jun 2026 10:06 UTC about 1 month ago

27 Jun 2026 10:06 UTC · about 1 month ago

Observed by KEVIntel sensors

Evidence-backed exploitation signal
27 Jun 2026 10:06 UTC about 1 month ago

27 Jun 2026 10:06 UTC · about 1 month ago

Indicators of compromise added (9)

Indicators of compromise recorded
8 Jun 2026 19:21 UTC about 2 months ago

8 Jun 2026 19:21 UTC · about 2 months ago

KEV confirmed by Rapid7

Exploitation attested by an external source
31 May 2026 00:00 UTC about 2 months ago

31 May 2026 00:00 UTC · about 2 months ago

KEV confirmed by The Shadowserver

Exploitation attested by an external source
25 Apr 2025 00:00 UTC over 1 year ago

25 Apr 2025 00:00 UTC · over 1 year ago

Nuclei template available

Scanner coverage available
30 May 2024 20:07 UTC about 2 years ago

30 May 2024 20:07 UTC · about 2 years ago

Nessus plugin available

Scanner coverage available
30 May 2024 07:55 UTC about 2 years ago

30 May 2024 07:55 UTC · about 2 years ago

Public PoC available

Public proof-of-concept code published
30 May 2024 00:00 UTC about 2 years ago

30 May 2024 00:00 UTC · about 2 years ago

Added to CISA KEV

Listed in the CISA Known Exploited Vulnerabilities catalog
30 May 2024 00:00 UTC about 2 years ago

30 May 2024 00:00 UTC · about 2 years ago

Used in qilin ransomware malware

Exploit observed in malware
28 May 2024 18:22 UTC about 2 years ago

28 May 2024 18:22 UTC · about 2 years ago

CVE published

Vulnerability disclosed publicly
1 Feb 2024 15:19 UTC over 2 years ago

1 Feb 2024 15:19 UTC · over 2 years ago

CVE ID reserved

Identifier reserved by the CNA

Automate This Intelligence with the Pro API

Confidence scoring, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.

View Pro Pricing View API Docs

Pro API Example

GET /api/v2/pro/kevs/CVE-2024-24919

{
  "cve_id": "CVE-2024-24919",
  "title": "Information disclosure",
  "affected_vendor": "checkpoint",
  "affected_product": "Check Point Quantum Gateway, Spark Gateway and CloudGuard Network",
  "affected_versions": [
    { "vendor": "...", "product": "...", "status": "affected", "display_label": "..." }
  ],
  "confidence": "Confirmed",
  "cvss_score": 8.6,
  "epss_score": 0.99978,
  "exploit_status": {
    "exploited_in_the_wild": true,
    "active_exploitation_observed": true
  },
  "sensor_telemetry": { "...": "Pro API fields" },
  "proof_of_concepts": [ "..." ],
  "scanner_integrations": [ "..." ]
}

The free JSON API returns basic KEV fields only. Confidence, telemetry, and artifact enrichment require Pro API access.

CVE-2024-24919

At a Glance

Affected Versions

CVE References

Known Exploited Vulnerability Sources

Observed Exploitation Attempts

Exploitation Attempts Over the Last 32 Days

See more exploitation detail

Indicators of Compromise (IoCs)

Observed Detection Signals (30d)

Scanner Artifacts

Virtual Patch

CVSS Scores

Exploitation Status

Weaknesses (CWE)

Scanner Integrations

Recent Mentions

Potential Proof of Concepts

Timeline

Automate This Intelligence with the Pro API