Vendor
checkpoint
33 known vulnerabilities.
checkpoint at a glance
2 of the exploited vulnerabilities are known to be used by ransomware (CISA).
Show as table
| Month | Vulnerabilities | Critical |
|---|---|---|
| Nov 2026 | 0 | 0 |
| Oct 2026 | 0 | 0 |
| Sep 2026 | 4 | 4 |
| Aug 2026 | 1 | 1 |
| Jul 2026 | 3 | 2 |
| Jun 2026 | 3 | 1 |
| May 2026 | 6 | 0 |
| Apr 2026 | 0 | 0 |
| Mar 2026 | 0 | 0 |
| Feb 2026 | 0 | 0 |
| Jan 2026 | 1 | 0 |
| Dec 2025 | 2 | 0 |
| Nov 2025 | 0 | 0 |
| Oct 2025 | 0 | 0 |
| Sep 2025 | 0 | 0 |
| Aug 2025 | 3 | 0 |
| Jul 2025 | 0 | 0 |
| Jun 2025 | 2 | 0 |
| May 2025 | 0 | 0 |
| Apr 2025 | 2 | 0 |
| Mar 2025 | 0 | 0 |
| Feb 2025 | 1 | 0 |
| Jan 2025 | 0 | 0 |
| Dec 2024 | 0 | 0 |
Products
Latest advisories
-
Critical max 9.8
Kwetsbaarheden verholpen in Check Point VPN-producten
Check Point heeft twee kritieke kwetsbaarheden verholpen in Quantum Security Gateway en Security Management.
first Sep 10, 2026 -
High max 9.8NCSC-2026-0384 1 CVE
Kwetsbaarheid verholpen in Check Point's Security Management and Log Servers
Check Point heeft een kwetsbaarheid verholpen in Check Point's Security Management and Log Servers.
-
Critical max 9.3
Kwetsbaarheden verholpen in Check Point Remote and Mobile Access VPN-producten
Check Point heeft kwetsbaarheden verholpen in Remote and Mobile Access VPN-producten, specifiek voor implementaties die gebruikmaken van het IKEv1 key exchange protocol.
first Jun 8, 2026 -
High max 8.6
Kwetsbaarheid verholpen in Check Point VPN producten
Check Point heeft een kwetsbaarheid verholpen in Quantum Gateway VPN systemen. Check Point meldt actieve pogingen tot misbruik waar te nemen.
33 results · Feed
-
Critical 9.8
Directory Traversal and File upload allows execution of arbitrary script on the Management Server
A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on Check Point Management Server.
KEV Sep 22, 2026 -
Critical 9.8CVE-2026-91843 Public exploit
Stack overflow in login process to the Security Management and Log Servers
A stack overflow during the unauthenticated login process may allow an attacker to run arbitrary code remotely with root privileges.
-
Critical 9.8CVE-2026-85103 Exploited
Heap-based Buffer Overflow in VPN Certificate ASN.1 Decoding
A heap-based buffer overflow in VPN certificate ASN.1 decoding may allow an unauthenticated remote attacker to execute arbitrary code on Check Point Quantum Security Management and Quantum Security Gateway systems.
-
Critical 9.8
Improper Certificate Validation in Quantum Security Gateway
Improper certificate trust validation during VPN negotiation in Check Point Quantum Security Gateway may allow an unauthenticated remote attacker to execute arbitrary code on the Gateway.
KEV Sep 22, 2026 -
Critical 9.3CVE-2026-18574 Public exploit
Authentication Bypass in Check Point Security Management Server
An authentication bypass vulnerability in Check Point Security Management Server and Multi-Domain Security Management Server (MDS) could allow an unauthenticated remote attacker with network access to Management services to execute arbitrary commands on the S…
-
High 7.5
Local Privilege Escalation in Gaia Portal
A vulnerability in Check Point Gaia Portal allows an authenticated attacker with read-only Gaia Portal privileges to execute commands with root privileges.
-
Critical 9.1
Management Authentication Bypass and Privilege Escalation
An authentication bypass vulnerability in Check Point Security Management and Multi-Domain Security Management allows an unauthenticated remote attacker to execute administrative commands on the Management Server. Successful exploitation may also allow comman…
-
Critical 9.3
Authentication Bypass in the SmartConsole Login Process Using an Application Token
An authentication bypass vulnerability in the Check Point SmartConsole login process allows an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges. Successful exploitation allows …
KEV Jul 22, 2026 -
High 7.8
Local Privilege Escalation vulnerability in Check Point Identity Agent Full for Windows OS
A local privilege escalation vulnerability exists in Check Point Identity Agent Full for Windows OS. An authenticated local user may be able to execute arbitrary code with SYSTEM privileges due to improper handling of executable resolution during the log coll…
-
Critical 9.3
User Authentication Bypass in VPN Remote Access and Mobile Access
A logic flow weakness in Remote Access and Mobile Access certificate validation in deprecated IKEv1 key exchange allows an unauthenticated remote attacker to bypass user authentication and establish a remote access VPN connection without a valid user password.
KEV Jun 8, 2026 -
High 7.4
Certificate Validation Bypass in VPN Site-to-Site Connections Using IKEv1
A weakness in the certificate validation logic of the deprecated IKEv1 key exchange may allow an unauthenticated attacker positioned as a man-in-the-middle to bypass certificate validation in VPN site-to-site connections that use certificate-based authenticat…
-
Medium 4.1
Authenticated Administrator Role-Based Access Control Bypass in Compliance
When Compliance is enabled on Check Point Multi-Domain Management, an authenticated administrator with read-write access to one Management Domain (CMA) can modify stored metadata associated with Compliance Best Practices in another Management Domain, where th…
-
Medium 5.3
HTTP service can incorrectly process malformed HTTP requests
A Check Point HTTP-based service can incorrectly handle malformed HTTP requests. The issue is related to HTTP request parsing and validation.
-
Medium 5.6
SQL injection issue in UserCheck Portal when DLP Software Blade is active
When the DLP is active, the UserCheck Web Portal contains an input-handling issue in the UserChoice flow. Under specific conditions, an attacker who can access the UserCheck Ask page could attempt to manipulate the Security Gateway's stored DLP/UserCheck inci…
-
High 7.5
Identity Awareness Captive Portal - Unauthenticated Local File Inclusion
When the Identity Awareness blade is enabled with Browser-Based Authentication, an unauthenticated user may be able to read certain internal files on the Security Gateway.
-
High 8.1
VPN service may restart unexpectedly when processing IKE traffic over NAT-T 4500/UDP
The Security Gateway does not correctly validate a length value in certain IKE packets when NAT-T is used (4500/UDP). As a result, a specially crafted or malformed packet can cause the VPN processing service to terminate unexpectedly, leading to denial of ser…
-
High 8.1
VPND IKE Fragment Reassembly - Heap Out-of-Bounds Write via Sequence Number Zero
The VPN service may mishandle an unexpected IKE fragment value received on the IKE port 500/UDP during the early stage of a connection attempt. This can cause the service to terminate unexpectedly, resulting in denial of service (temporary disruption of VPN-r…
-
High 7.5
Local privilege escalation in Harmony SASE Windows Agent
A local user can trigger Harmony SASE Windows client to write or delete files outside the intended certificate working directory.
-
Medium 6.5
Information Disclosure in Identity Agent Debug Files
An authenticated local user can obtain information that allows claiming security policy rules of another user due to sensitive information being printed in plaintext in Identity Agent for Terminal Services debug files.
-
Medium 6.5
Information Disclosure in Identity Agent Registry Keys
An authenticated local user can obtain information that allows claiming security policy rules of another user due to sensitive information being accessible in the Windows Registry keys for Check Point Identity Agent running on a Terminal Server.
-
High 8.1
Exposed SFTP server
Log files uploaded during troubleshooting by the Harmony SASE agent may have been accessible to unauthorized parties.
-
Medium 5.0
Path Traversal
The Mobile Access Portal's File Share application is vulnerable to a directory traversal attack, allowing an authenticated, malicious end-user (authorized to at least one File Share application) to list the file names of 'nobody'-accessible directories on the…
-
Medium 6.5
Lack of TLS validation
Lack of TLS validation when downloading a CSV file including mapping from IPs to countries used ONLY for displaying country flags in logs
-
Medium 6.1
SmartConsole Sensitive Credential Exposure via Memory Dump
Credentials are not cleared from memory after being used. A user with Administrator permissions can execute memory dump for SmartConsole process and fetch them.
-
Medium 6.5
DLL-HiJacking
Untrusted DLLs in the installer's directory may be loaded and executed, leading to potentially arbitrary code execution with the installer's privileges (admin).
-
Medium 5.4
Stored-XSS
For an authenticated end-user the portal may run a script while attempting to display a directory or some file's properties.
-
Low 3.5
Self-XSS
Authenticated end-user may set a specially crafted SNX bookmark that can make their browser run a script while accessing their own bookmark list.
-
Medium 5.3
Out of Bounds read in the CPCA process on Check Point Management Server
In rare scenarios, the cpca process on the Security Management Server / Domain Management Server may exit unexpectedly, creating a core dump file. When the cpca process is down, VPN and SIC connectivity issues may occur if the CRL is not present in the Securi…
-
High 8.0
Authenticated Gaia users can inject code or commands by global variables through special HTTP requests. A Security fix …
-
High 8.6
Information disclosure
Potentially allowing an attacker to read certain information on Check Point Security Gateways once connected to the internet and enabled with remote Access VPN or Mobile Access Software Blades. A Security fix that mitigates this vulnerability is available.
KEV May 30, 2024 -
Medium 6.7
Local privilege escalation in Harmony Endpoint Security Client for Windows via crafted DLL file
A local privilege escalation vulnerability has been identified in Harmony Endpoint Security Client for Windows versions E88.10 and below. To exploit this vulnerability, an attacker must first obtain the ability to execute local privileged code on the target s…
-
High 7.3
LocalprivilegeescalationinCheckPointZoneAlarmExtremeSecurityNextGen,IdentityAgentforWindows,andIdentityAgentforWindowsTerminalServerviacraftedDLLfile
A local attacker can erscalate privileges on affected Check Point ZoneAlarm ExtremeSecurity NextGen, Identity Agent for Windows, and Identity Agent for Windows Terminal Server. To exploit this vulnerability, an attacker must first obtain the ability to execut…
-
High 7.8
Local Privliege Escalation in Check Point Endpoint Security Remediation Service
Local attacker can escalate privileges on affected installations of Check Point Harmony Endpoint/ZoneAlarm Extreme Security. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.