CVE-2024-24919: Check Point Security Gateway information disclosure, exploited in the wild
The short version: CVE-2024-24919 lets an unauthenticated attacker read sensitive files from internet-facing Check Point Security Gateways that have IPsec VPN, remote-access VPN, or the mobile-access blade enabled. On paper it's "just" information disclosure — but what it reads can include the material needed to take over the gateway. It was exploited as a zero-day and it's in CISA's KEV catalog. Steady hands — patch, then rotate.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | High — in practice (an info leak that leads to takeover) |
| CVSS v3.1 (NVD) | Unknown at time of writing — NVD shows no NVD-assigned base score |
| CVSS (Check Point, CNA) | 8.6 — High · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N |
| EPSS | 99.98% · 99.98th percentile (2026-07-17) |
| In CISA KEV? | Yes — remediation was due 2024-06-20 |
| Known exploited? | Yes — exploited as a zero-day before the hotfix |
| Vulnerability type | CWE-200 information disclosure via arbitrary file read → path to full gateway compromise |
| Requires authenticated session? | No — pre-authentication |
| Affected | Security Gateways with remote-access VPN or mobile-access enabled (Quantum, Quantum Spark, CloudGuard on R80.40, R81, R81.10, R81.20 and related builds) |
| Fixed in | Preventative hotfixes per Check Point sk182336 |
What you need to know
A crafted request lets an unauthenticated attacker read files on the gateway they should never be able to reach. That's the whole problem, and it's worse than "information disclosure" sounds:
- It's pre-authentication and internet-reachable. Remote-access VPN portals are meant to be internet-facing, so there's no credential and no chain.
- What it leaks enables takeover. Attackers used it to pull sensitive material — early activity focused on gateways using local accounts with password-only authentication, and the leaked data can lead to full compromise of the device.
- It was a zero-day. Check Point observed in-the-wild exploitation before publishing, so an affected gateway may have been touched before you patched.
How serious we see it
High — in practice, above the "information disclosure" label.
This is the same pattern we flag elsewhere: when the "information" being disclosed is the key to an authenticated, internet-facing access device, an info-leak behaves like a full compromise. We rate it by what it does — read the secrets off a VPN gateway and walk in — not by which CVSS metric box it lands in. The bounded, reassuring part is that hotfixes are published and exposure is quick to determine. The catch is the zero-day window: patching closes the hole, but it doesn't rotate the credentials that may already have leaked.
Recommendations
Straight from Check Point's guidance and CISA:
- Apply the hotfix now. Install the preventative hotfix for your platform per Check Point sk182336.
- Rotate what could have leaked — the step people miss. Reset local account passwords and rotate certificates and secrets on the gateway; move off password-only local accounts.
- Hunt for prior use. Review authentication and access logs for anomalous sessions and file access predating the fix.
- Harden exposure. Enforce certificate-based / multi-factor authentication and limit which management and VPN interfaces are internet-reachable.
- Confirm your exposure first. Verify whether you run an affected gateway with remote-access or mobile-access enabled.
How BreachRisk sees it
BreachRisk starts from the outside, the way an attacker does. From little more than your domain it discovers internet-facing Check Point VPN portals, fingerprints the device, and flags exposure tied to KEV-listed, actively exploited vulnerabilities like this one — pushed to the top of your results because it's in KEV and because our severity take reflects the real-world impact, not just the base score. We detect and flag the exposed, affected gateway; we don't exploit it.
The continuous attacker's-eye view is exactly for flaws like this, where the label undersells the danger: the exposed appliance is ranked by how it actually gets used against you, so it was already on your radar when the zero-day broke.