What We Do
How We Do
Get Started
Security advisories

Check Point Zero-Day Targeted in Ongoing Attacks

May 29, 2024 | 1 MIN READ

Speak With A Security Expert Now



On May 28th, Check Point confirmed the existence of an actively exploited zero-day vulnerability impacting Check Point Security Gateways. The vulnerability, tracked as CVE-2024-24919 (CVSS: 7.5), is an information disclosure vulnerability. Exploitation would allow a remote threat actor to read certain information on Check Point Security Gateways if IPSec VPN or Mobile Access Software Blades are enabled.

Details relating to CVE-2024-24919 and real-world exploitation are currently minimal. According to Check Point, attacks have been confirmed against a “small number of customers”. Threat actors are believed to be exploiting the vulnerability to steal information that would enable remote access into victim environments. As exploitation is ongoing, it is paramount that organizations utilizing Check Point Security Gateways apply the available remediations.

What we’re doing about it

What you should do about it

Additional information

CVE-2024-24919 impacts all Check Point Security Gateways that have either IPSec VPN or Mobile Access Software Blades enabled. As exploitation is ongoing, organizations employing vulnerable products need to take immediate action to address the vulnerability.

While details on real-world exploitation are currently minimal, Check Point has confirmed that exploitation has impacted organizations that continue to use password only authentication. It is probable that exploitation of CVE-2024-24919 enables the theft of credentials, which may then be used to achieve initial access; post compromise activity is unknown at the time of writing. Employing a Multi-Factor Authentication (MFA) solution will significantly limit the value of compromised credentials, as they will no longer enable direct access.

The eSentire Threat Intelligence team continues to track this topic for additional details relating to exploitation and information relevant to engineering new detections.


[1] https://blog.checkpoint.com/security/enhance-your-vpn-security-posture
[2] https://support.checkpoint.com/results/sk/sk182337
[3] https://nvd.nist.gov/vuln/detail/CVE-2024-24919
[4] https://www.tenable.com/cve/CVE-2024-24919

View Most Recent Advisories