CVE-2024-24919Active Exploitation(checkpoint / cloudguard_network_security)

#threatreport #LowCompleteness CVE-2026-16232: Critical Check Point SmartConsole Authentication Bypass Exploited in the Wild | 23-07-2026 Source: https://www.rapid7.com/blog/post/etr-cve-2026-16232-critical-check-point-smartconsole-authentication-bypass-exploited-in-the-wild Key details below ↓ 🎯Victims: Network security, Firewall management, Cybersecurity 🔓CVEs: CVE-2026-62144 \[[Vulners](https://vulners.com/cve/CVE-2026-62144)] - CVSS V3.1: *9.1*, - Vulners: Exploitation: Unknown CVE-2024-24919 \[[Vulners](https://vulners.com/cve/CVE-2024-24919)] - CVSS V3.1: *8.6*, - Vulners: Exploitation: True Soft: - checkpoint quantum_spark_firmware (r80.40) CVE-2026-50751 \[[Vulners](https://vulners.com/cve/CVE-2026-50751)] - CVSS V3.1: *9.3*, - Vulners: Exploitation: True Soft: - checkpoint gaia_os (<r81.20, r82, r82.10) CVE-2026-62145 \[[Vulners](https://vulners.com/cve/CVE-2026-62145)] - CVSS V3.1: *7.5*, - Vulners: Exploitation: Unknown CVE-2026-16232 \[[Vulners](https://vulners.com/cve/CVE-2026-16232)] - CVSS V3.1: *9.1*, - Vulners: Exploitation: True 📚TTPs: ⚔️Tactics: 1 🛠️Technics: 0 🤖LLM extracted TTPs:` T1098, T1190, T1210, T1550.001, T1562 🧨IOCs: - IP: 6 #threatreport: CVE-2026-16232, a critical vulnerability identified in Check Point's SmartConsole, has been classified as an authentication bypass and has been assigned a CVSS score of 9.1. This vulnerability, associated with improper authentication (CWE-287), allows remote attackers—without requiring authentication—to acquire an application login token. Consequently, they can authenticate to the management server with full administrative privileges, providing them the capacity to modify essential security policies and configurations. The vulnerability is particularly severe as it compromises the Security Management Server, which is crucial in the trust hierarchy of security management. An attacker with administrative access can manipulate various configurations, including altering administrator permissions and VPN settings, potentially undermining logging and monitoring mechanisms. Check Point noted that this flaw had been actively exploited in the wild and detected in a limited number of customer environments. Remote exploitation necessitates that the attacker has network access to the Management Server IP address in systems where Trusted Clients are not restricted. CVE-2026-16232 was included on the U.S. Cybersecurity and Infrastructure Security Agency's (CISA) list of known exploited vulnerabilities following Check Point's advisory published on July 22, 2026. Organizations were given an urgent three-day window to respond to this vulnerability before a remediation deadline of July 25, 2026. This vulnerability highlights ongoing issues with Check Point's products, which have recently faced multiple in-the-wild vulnerabilities, underscoring the critical need for timely updates and patches in network security environments. To mitigate CVE-2026-16232, Check Point released Jumbo Hotfixes, also addressing vulnerabilities CVE-2026-62144 and CVE-2026-62145, on the same day as their advisory. Affected organizations are advised to implement these patches on an emergency basis without waiting for the normal patch cycle, especially for versions R81.10, R81.20, R82, and R82.10. Additionally, tools such as Exposure Command, InsightVM, and Nexpose are expected to provide authenticated vulnerability checks to help organizations assess their exposure to this critical vulnerability in their networks.

CVE-2026-16232 is an authentication bypass in Check Point's SmartConsole management interface, actively exploited in the wild and added to CISA's Known Exploited Vulnerabilities catalog this week. It is the third authentication bypass in Check Point's management products in eighteen months. The second, CVE-2026-50751, was exploited in zero-day attacks by the Qilin ransomware gang in June. The first, CVE-2024-24919, was exploited by ransomware gangs two years ago. The pattern is not the individual vulnerability. It is that management interfaces, which control every security policy an organization has deployed, keep becoming the entry point. The administrative plane is the highest-value target in the estate, and it keeps presenting the same structural weakness. https://www.bleepingcomputer.com/news/security/check-point-patches-smartconsole-zero-day-exploited-in-attacks/ #CISO

The floor drops out from under Check Point's VPN gateways this morning. CVE-2026-50751 is an authentication bypass on Check Point VPN Remote Access — no credentials required, no user interaction, fully remote — and a Qilin ransomware affiliate is already using it for initial access. Check Point Research confirmed the attribution themselves, which is notable: the vendor naming the attacker in their own threat intel report is not standard practice. The exposure window is open, globally, right now, on every internet-facing Check Point Mobile Access gateway. The pre-auth bypass is the critical escalation from Check Point's prior VPN CVEs. CVE-2024-24919 — CVSS 8.6, KEV-listed, exploited within days of its 2024 disclosure — still required some foothold to leverage. CVE-2026-50751 strips that requirement entirely. The attacker walks in through the front door. No phishing. No credentials to steal. No user to fool. It always does come down to the perimeter when the perimeter has a door with no lock. Qilin's 2026 victim count is past 500 claimed on their leak site, putting them in the top tier of active ransomware groups — second-highest Q1 on record against 2,122 total ransomware victims globally per Check Point Research. Their RaaS model means the affiliate base is broad and the tooling is mature. MoxFive published a full Qilin TTP guide this week. A fresh zero-day in a widely deployed VPN product is exactly the kind of initial access vector a well-resourced affiliate operation goes shopping for. MITRE framing: T1190 (Exploit Public-Facing Application) is the primary initial access vector. T1133 (External Remote Services) for post-exploitation persistence and lateral reach. T1078 (Valid Accounts) for credential harvest and movement once inside. T1486 (Data Encrypted for Impact) and T1657 (Financial Extortion) for the inevitable downstream. The playbook is documented. The tooling is mature. The zero-day is fresh. KEV listing is not yet confirmed as of this morning — CVE-2026-50751 was disclosed today, June 8, and the pipeline lag is expected — but it is effectively certain within 24 to 48 hours given active exploitation by a named ransomware gang with 500+ victims already this year. The 2024 Check Point VPN KEV moved fast. Expect the same cadence. Federal agencies should not wait for the CISA clock to start. The risk calculus here is straightforward. VPN gateways sit at the edge of internal networks, carry broad lateral movement potential post-access, and are frequently over-permissioned. Qilin's 2026 pace suggests they are not being selective about targets. This is not a "patch in the next sprint" situation. It is an "identify every exposed Check Point Mobile Access gateway in the next hour" situation. Patch tonight. Seriously.

5/ Urgent alert for IT admins: A critical zero-day flaw (CVE-2024-24919) in Check Point's Security Gateways is being actively exploited, allowing attackers to steal credentials and move deep inside corporate networks.

@VceOfReason Weiß man selbst bei der @CDU, dass man in 🇩🇪 zwar zu doof für VPN (Zero Day, Check Point) ist, aber trotzdem laut KI-Fernsehen nur "Daten aus einem Kalender des Parteivorsitzenden abgeflossen sind". Nach @realDonaldTrump? 😂 https://nvd.nist.gov/vuln/detail/cve-2024-24919 https://www.zdfheute.de/politik/deutschland/cdu-cyber-angriff-merz-100.html https://t.co/EzIbvBgWf4

TRC analysis shows attackers exploiting CVE-2024-24919 to gain unauthenticated root access on Check Point management servers. The attack bypasses authentication by spoofing server identity, then uses directory traversal to achieve arbitrary file writes and code execution. Compromise of centralized management infrastructure positions attackers to manipulate firewall policies across entire gateway estates. #CloudSecurity 🔗 Full TRC analysis: https://aviatrix.ai/threat-research-center/check-point-management-cve-2026-93616-weaponizing

TRC analysis shows attackers exploiting CVE-2024-24919 in Check Point VPN gateways using crafted certificates to achieve pre-auth RCE. Following compromise, threat actors leveraged VPN infrastructure for lateral movement and data exfiltration through encrypted channels. Runtime segmentation helps contain post-compromise activity when perimeter defenses fail. #ZeroDay #CloudSecurity 🔗 Full TRC analysis: https://aviatrix.ai/threat-research-center/check-point-security-gateway-vpn-rce-cve-2026-85102-exploitation

This week's takeaway? Attackers are aggressively exploiting: 🔴 CVE-2026-42897 (Microsoft OWA/Exchange) 🔴 CVE-2026-54121 (AD CS) - Privilege escalation for persistent domain access 🔴 CVE-2024-55591 &amp; CVE-2024-21762 🔴 CVE-2024-24919 https://scrutex.ai/blogs/weekly-ransomware-intelligence-report-august-2-2026

#threatreport #LowCompleteness Critical Check Point VPN Zero-Day Exploited in the Wild (CVE-2026-50751) | 08-06-2026 Source: https://www.rapid7.com/blog/post/etr-critical-check-point-vpn-zero-day-exploited-in-the-wild-cve-2026-50751 Key details below ↓ 💀Threats: Qilin_ransomware, Mitm_technique, 🎯Victims: Organizations 🔓CVEs: CVE-2026-50752 \[[Vulners](https://vulners.com/cve/CVE-2026-50752)] - CVSS V3.1: *Unknown*, - Vulners: Exploitation: Unknown CVE-2026-50751 \[[Vulners](https://vulners.com/cve/CVE-2026-50751)] - CVSS V3.1: *Unknown*, - Vulners: Exploitation: Unknown CVE-2024-24919 \[[Vulners](https://vulners.com/cve/CVE-2024-24919)] - CVSS V3.1: *Unknown*, - Vulners: Exploitation: Unknown 🤖LLM extracted TTPs:` T1190, T1557 🧨IOCs: - IP: 9 - Hash: 2 🔢Algorithms: md5 #threatreport: On June 8, 2026, Check Point disclosed a critical authentication bypass vulnerability, CVE-2026-50751, impacting its Remote Access VPN, Mobile Access, and Spark Firewall products. This vulnerability, rated with a CVSS score of 9.3, is particularly significant as it relates to the older IKEv1 key exchange protocol. It allows unauthenticated attackers to establish a VPN session without valid credentials due to a flaw in the validation of certificates during the IKEv1 key exchange process. Organizations using configurations that still accept these legacy Remote Access clients are at high risk. Although attackers can initiate a VPN session, they would require further post-authentication actions to access internal resources or escalate privileges. The exploitation of CVE-2026-50751 has already been observed in the wild, with reports of attacks dating back to May 7, 2026, and an uptick in activity noted in early June. This campaign has primarily targeted dozens of organizations, with notable affiliations to cyber criminal entities, including a Qilin ransomware affiliate. Rapid7 has confirmed at least one incident tied to this vulnerability with a high confidence level. In addition to CVE-2026-50751, Check Point identified a related flaw, CVE-2026-50752, which has a CVSS score of 7.4. This vulnerability could allow man-in-the-middle attacks on site-to-site VPN configurations, but no exploitation has been detected for this issue as of now. In light of these vulnerabilities, it is crucial for organizations utilizing Check Point products to promptly apply the hotfixes released for CVE-2026-50751, given the active exploitation. Check Point advises affected entities to eliminate support for legacy remote access clients, configure global properties to require IKEv2 authentication exclusively, mandate machine certificate authentication, and enable Intrusion Prevention System (IPS) features while ensuring that the latest signatures are downloaded. Organizations should not delay applying these updates and should prioritize their implementation to safeguard against emerging threats.

4/ URGENT: A critical zero-day flaw (CVE-2024-24919) in Check Point VPNs is being actively exploited. Attackers are stealing credentials from corporate networks. CISA has issued a patch-now directive.

🚨 𝐅𝐫𝐞𝐬𝐡 𝐂𝐕𝐄 𝐚𝐥𝐞𝐫𝐭 𝐣𝐮𝐬𝐭 𝐢𝐧! Uncover how CVE-2024-24919 enables information disclosure on Check Point gateways and why rapid patching matters for preventing breach risk today. 🔗 Read the full breakdown → https://www.purple-ops.io/cybersecurity-threat-intelligence-blog/cve-2024-24919-checkpoint-flaw/ Join the discussion and tell us what you think!