CVE-2024-24919: Check Point Quantum Security Gateways Information Disclosure Vulnerability

Is it exploited?

Yes. CISA added it to the Known Exploited Vulnerabilities catalog on 30 May 2024, 2 days after the CVE record was published.

How likely is exploitation in the next 30 days?

100%

EPSS score, percentile 100 of all scored records

How severe?

8.6 High

CVSS v3.1 base score, given by the CNA

What should I do?

CISA deadline 20 Jun 2024. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

The CVE record links no vendor advisory, patch or mitigation.

Which versions are affected?

Affected

• Check Point Quantum Gateway and CloudGuard Network versions R81.20, R81.10, R81…

Versions by product

Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.28, as of 28 Oct 2026; FIRST Exploit Prediction Scoring System (EPSS), v2026.06.15, as of 28 Oct 2026; CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026. About the data.

What to do

CISA due date for this action: 20 June 2024.

Advisories and patches

The CVE record links no vendor advisory, patch or mitigation.

Linked from CISA's catalog entry

• https://support.checkpoint.com/results/sk/sk182336
• https://nvd.nist.gov/vuln/detail/CVE-2024-24919

Affected products and versions

As listed in the CVE record.

Source: CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026. About the data.

About this vulnerability

Check Point Quantum Security Gateways contain an unspecified information disclosure vulnerability. The vulnerability potentially allows an attacker to access information on Gateways connected to the internet, with IPSec VPN, Remote Access VPN or Mobile Access enabled. This issue affects several product lines from Check Point, including CloudGuard Network, Quantum Scalable Chassis, Quantum Security Gateways, and Quantum Spark Appliances.

Summary: CISA's KEV catalog, as of 28 Oct 2026.

• CISA added CVE-2024-24919 to its Known Exploited Vulnerabilities (KEV) catalog on 30 May 2024.
• CISA marks it as known to be used in ransomware campaigns.
• The due date CISA sets for the required action is 20 Jun 2024.
• The CVE record was published on 28 May 2024, 2 days before it was added to KEV.
• The CVE record carries a CVSS v3.1 base score of 8.6 (High), given by its CNA.
• FIRST's EPSS model puts the probability of exploitation in the next 30 days at 100% (percentile 100), as of 28 Oct 2026.
• CISA's SSVC assessment in the CVE record: exploitation active, automatable yes, technical impact partial.

Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.28, as of 28 Oct 2026; CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026; FIRST Exploit Prediction Scoring System (EPSS), v2026.06.15, as of 28 Oct 2026. About the data.

Description

Information disclosure

Potentially allowing an attacker to read certain information on Check Point Security Gateways once connected to the internet and enabled with remote Access VPN or Mobile Access Software Blades. A Security fix that mitigates this vulnerability is available.

Source: CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026. About the data.

Weakness

• CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

CWE and CAPEC are maintained by MITRE; the entries are those named in the CVE record and the KEV entry.

Timeline

References

• support.checkpoint.com

More exploited Check Point vulnerabilities

• CVE-2026-85102: Check Point Multiple Products Improper Certificate Validation Vulnerability (added 22 Sep 2026)
• CVE-2026-93616: Check Point Multiple Products Path Traversal Vulnerability (added 22 Sep 2026)
• CVE-2026-16232: Check Point SmartConsole Improper Authentication Vulnerability (added 22 Jul 2026)
• CVE-2026-50751: Check Point Security Gateway Improper Authentication Vulnerability (added 8 Jun 2026)