Check Point vulnerabilities
We track 29 vulnerabilities in Check Point products across 33 products. 29 are rated high or critical, and 8 have been exploited in real attacks. The most recent was published on November 12, 2026.
Latest Check Point vulnerabilities
- 7.8 High severity
Check Point Multiple Products Incorrect Permission Assignment for Critical Resource Exploited
The Gaia OS DynamicCLI daemon runs as root and listens on a world-writable local socket (/tmp/dynamic_socket) without authenticating connecting processes. An authenticated local user can send a command to the socket and have it executed as root.
- 7.3 High severity
Quantum Security Gateway: Improper Privilege Management
An input and authorization validation vulnerability in Gaia Portal backend handlers could allow an authenticated, non-administrative user to perform privileged operations that should be restricted to administrators.
- 9.8 Critical severity
Check Point Multiple Products Path Traversal Exploited
A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on Check Point Management Server.
- 9.8 Critical severity
Quantum Security Gateway: Heap-based Buffer Overflow
A heap-based buffer overflow in VPN certificate ASN.1 decoding may allow an unauthenticated remote attacker to execute arbitrary code on Check Point Quantum Security Management and Quantum Security Gateway systems.
- 9.8 Critical severity
Check Point Multiple Products Improper Certificate Validation Exploited
Improper certificate trust validation during VPN negotiation in Check Point Quantum Security Gateway may allow an unauthenticated remote attacker to execute arbitrary code on the Gateway.
- 9.3 Critical severity
Security Management Server: Authentication Bypass Using an Alternate Path or Channel
An authentication bypass vulnerability in Check Point Security Management Server and Multi-Domain Security Management Server (MDS) could allow an unauthenticated remote attacker with network access to Management services to execute arbitrary commands on the Se
- 7.5 High severity
Quantum Security Gateway: Improper Privilege Management
A vulnerability in Check Point Gaia Portal allows an authenticated attacker with read-only Gaia Portal privileges to execute commands with root privileges.
- 9.1 Critical severity
Quantum Security Management: Improper Authentication
An authentication bypass vulnerability in Check Point Security Management and Multi-Domain Security Management allows an unauthenticated remote attacker to execute administrative commands on the Management Server. Successful exploitation may also allow command
- 9.8 Critical severity
Check Point SmartConsole Improper Authentication Exploited
An authentication bypass vulnerability in the Check Point SmartConsole login process allows an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges. Successful exploitation allows t
- 7.8 High severity
Identity Agent: Uncontrolled Search Path Element
A local privilege escalation vulnerability exists in Check Point Identity Agent Full for Windows OS. An authenticated local user may be able to execute arbitrary code with SYSTEM privileges due to improper handling of executable resolution during the log colle
- 7.4 High severity
Quantum Security Gateway: Improper Certificate Validation
A weakness in the certificate validation logic of the deprecated IKEv1 key exchange may allow an unauthenticated attacker positioned as a man-in-the-middle to bypass certificate validation in VPN site-to-site connections that use certificate-based authenticati
- 9.3 Critical severity
Check Point Security Gateway Improper Authentication Exploited
A logic flow weakness in Remote Access and Mobile Access certificate validation in deprecated IKEv1 key exchange allows an unauthenticated remote attacker to bypass user authentication and establish a remote access VPN connection without a valid user password.
- 7.5 High severity
Quantum Security Gateway: Improper Control of Filename for Include/Require Statement in PHP Program
When the Identity Awareness blade is enabled with Browser-Based Authentication, an unauthenticated user may be able to read certain internal files on the Security Gateway.
- 8.1 High severity
Quantum Security Gateway: Out-of-bounds Read
The Security Gateway does not correctly validate a length value in certain IKE packets when NAT-T is used (4500/UDP). As a result, a specially crafted or malformed packet can cause the VPN processing service to terminate unexpectedly, leading to denial of serv
- 8.1 High severity
Quantum Security Gateway: Heap-based Buffer Overflow
The VPN service may mishandle an unexpected IKE fragment value received on the IKE port 500/UDP during the early stage of a connection attempt. This can cause the service to terminate unexpectedly, resulting in denial of service (temporary disruption of VPN-re
- 7.2 High severity
Check Point SmartConsole: Cleartext Storage of Sensitive Information
Credentials are not cleared from memory after being used. A user with Administrator permissions can execute memory dump for SmartConsole process and fetch them.
- 7.8 High severity
Check Point SmartConsole: Uncontrolled Search Path Element
Untrusted DLLs in the installer's directory may be loaded and executed, leading to potentially arbitrary code execution with the installer's privileges (admin).
- 7.5 High severity
Multi-Domain Security Management, Quantum…: Out-of-bounds Read
In rare scenarios, the cpca process on the Security Management Server / Domain Management Server may exit unexpectedly, creating a core dump file. When the cpca process is down, VPN and SIC connectivity issues may occur if the CRL is not present in the Securit
- 7.8 High severity
ZoneAlarm Extreme Security: Improper Link Resolution Before File Access
Check Point ZoneAlarm Extreme Security Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Check Point ZoneAlarm Extreme Security. An attacker must first obtain
- 8.0 High severity
ClusterXL, Multi-Domain Security Management…: Improper Control of Dynamically-Identified Variables
Authenticated Gaia users can inject code or commands by global variables through special HTTP requests. A Security fix that mitigates this vulnerability is available.
- 8.6 High severity
Check Point Quantum Security Gateways Information Disclosure Exploited
Potentially allowing an attacker to read certain information on Check Point Security Gateways once connected to the internet and enabled with remote Access VPN or Mobile Access Software Blades. A Security fix that mitigates this vulnerability is available.
- 7.3 High severity
ZoneAlarmExtremeSecurityNextGen,IdentityAgentfo…: Incorrect Permission Assignment for Critical Resource
A local attacker can erscalate privileges on affected Check Point ZoneAlarm ExtremeSecurity NextGen, Identity Agent for Windows, and Identity Agent for Windows Terminal Server. To exploit this vulnerability, an attacker must first obtain the ability to execute
- 7.8 High severity
Harmony Endpoint.: Incorrect Permission Assignment for Critical Resource
Local attacker can escalate privileges on affected installations of Check Point Harmony Endpoint/ZoneAlarm Extreme Security. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
- 7.5 High severity
Gateway & Management, IPsec VPN blade SNX…: Improper Restriction of Excessive Authentication Attempts
The IPsec VPN blade has a dedicated portal for downloading and connecting through SSL Network Extender (SNX). If the portal is configured for username/password authentication, it is vulnerable to a brute-force attack on usernames and passwords.
- 8.8 High severity
Zonealarm: Improper Privilege Management
Check Point ZoneAlarm Extreme Security before 15.8.211.19229 allows local users to escalate privileges. This occurs because of weak permissions for the %PROGRAMDATA%\CheckPoint\ZoneAlarm\Data\Updates directory, and a self-protection driver bypass that allows c
- 7.5 High severity
Checkpoint Harmony Capsule Workspace: Out-of-bounds Write
A potential memory corruption issue was found in Capsule Workspace Android app (running on GrapheneOS). This could result in application crashing but could not be used to gather any sensitive information.
- 7.8 High severity
Check Point Endpoint Security Client for Windows: Improper Link Resolution Before File Access
Check Point Endpoint Security Client for Windows versions earlier than E86.40 copy files for forensics reports from a directory with low privileges. An attacker can replace those files with malicious or linked content, such as exploiting CVE-2020-0896 on unpat
- 9.8 Critical severity
GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Exploited
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or possibly have unknown other impact via a crafted environment, as
- 9.8 Critical severity
GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Exploited
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vectors involving the ForceCommand feature