Checkpoint
108 CVEs across 115 Checkpoint products. Browse Checkpoint vulnerabilities, severities, and proof-of-concept exploits.
Checkpoint products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-18574 | | 2026-08-03 | An authentication bypass vulnerability in Check Point Security Management Server and Multi-Domain Security Management Server (MDS) could allow an unauthenticat… | |
CVE-2026-62145 | High | 7.5 | 2026-07-22 | A vulnerability in Check Point Gaia Portal allows an authenticated attacker with read-only Gaia Portal privileges to execute commands with root privileges. |
CVE-2026-62144 | Critical | 9.1 | 2026-07-22 | An authentication bypass vulnerability in Check Point Security Management and Multi-Domain Security Management allows an unauthenticated remote attacker to exe… |
CVE-2026-16232 | Critical | 9.8 | 2026-07-22 | An authentication bypass vulnerability in the Check Point SmartConsole login process allows an unauthenticated remote attacker to obtain an application login t… |
CVE-2026-10847 | High | 7.8 | 2026-06-11 | A local privilege escalation vulnerability exists in Check Point Identity Agent Full for Windows OS. An authenticated local user may be able to execute arbitra… |
CVE-2026-50752 | High | 7.4 | 2026-06-08 | A weakness in the certificate validation logic of the deprecated IKEv1 key exchange may allow an unauthenticated attacker positioned as a man-in-the-middle to… |
CVE-2026-50751 | Critical | 9.3 | 2026-06-08 | A logic flow weakness in Remote Access and Mobile Access certificate validation in deprecated IKEv1 key exchange allows an unauthenticated remote attacker to b… |
CVE-2026-48136 | Medium | 4.1 | 2026-05-26 | When Compliance is enabled on Check Point Multi-Domain Management, an authenticated administrator with read-write access to one Management Domain (CMA) can mod… |
CVE-2026-48135 | Medium | 5.3 | 2026-05-26 | A Check Point HTTP-based service can incorrectly handle malformed HTTP requests. The issue is related to HTTP request parsing and validation. |
CVE-2026-48134 | Medium | 5.6 | 2026-05-26 | When the DLP is active, the UserCheck Web Portal contains an input-handling issue in the UserChoice flow. Under specific conditions, an attacker who can access… |
CVE-2026-48133 | High | 7.5 | 2026-05-26 | When the Identity Awareness blade is enabled with Browser-Based Authentication, an unauthenticated user may be able to read certain internal files on the Secur… |
CVE-2026-48132 | High | 8.1 | 2026-05-26 | The Security Gateway does not correctly validate a length value in certain IKE packets when NAT-T is used (4500/UDP). As a result, a specially crafted or malfo… |
CVE-2026-48131 | High | 8.1 | 2026-05-26 | The VPN service may mishandle an unexpected IKE fragment value received on the IKE port 500/UDP during the early stage of a connection attempt. This can cause… |
CVE-2025-9142 | High | 7.5 | 2026-01-14 | A local user can trigger Harmony SASE Windows client to write or delete files outside the intended certificate working directory. |
CVE-2025-8305 | Medium | 6.5 | 2025-12-22 | An authenticated local user can obtain information that allows claiming security policy rules of another user due to sensitive information being printed in pla… |
CVE-2025-8304 | Medium | 6.5 | 2025-12-22 | An authenticated local user can obtain information that allows claiming security policy rules of another user due to sensitive information being accessible in… |
CVE-2025-3831 | High | 8.1 | 2025-08-12 | Log files uploaded during troubleshooting by the Harmony SASE agent may have been accessible to unauthorized parties. |
CVE-2025-2028 | Medium | 6.5 | 2025-08-06 | Lack of TLS validation when downloading a CSV file including mapping from IPs to countries used ONLY for displaying country flags in logs |
CVE-2024-52885 | Medium | 5.0 | 2025-08-06 | The Mobile Access Portal's File Share application is vulnerable to a directory traversal attack, allowing an authenticated, malicious end-user (authorized to a… |
CVE-2024-24915 | Medium | 6.1 | 2025-06-29 | Credentials are not cleared from memory after being used. A user with Administrator permissions can execute memory dump for SmartConsole process and fetch them. |
CVE-2024-24916 | Medium | 6.5 | 2025-06-19 | Untrusted DLLs in the installer's directory may be loaded and executed, leading to potentially arbitrary code execution with the installer's privileges (admin). |
CVE-2024-52888 | Medium | 5.4 | 2025-04-27 | For an authenticated end-user the portal may run a script while attempting to display a directory or some file's properties. |
CVE-2024-52887 | Low | 3.5 | 2025-04-27 | Authenticated end-user may set a specially crafted SNX bookmark that can make their browser run a script while accessing their own bookmark list. |
CVE-2024-24911 | Medium | 5.3 | 2025-02-06 | In rare scenarios, the cpca process on the Security Management Server / Domain Management Server may exit unexpectedly, creating a core dump file. When the cpc… |
CVE-2024-6233 | High | 7.8 | 2024-11-22 | Check Point ZoneAlarm Extreme Security Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privilege… |
CVE-2024-24914 | High | 8.0 | 2024-11-07 | Authenticated Gaia users can inject code or commands by global variables through special HTTP requests. A Security fix that mitigates this vulnerability is ava… |
CVE-2024-24919 | High | 8.6 | 2024-05-28 | Potentially allowing an attacker to read certain information on Check Point Security Gateways once connected to the internet and enabled with remote Access VPN… |
CVE-2024-24912 | Medium | 6.7 | 2024-05-01 | A local privilege escalation vulnerability has been identified in Harmony Endpoint Security Client for Windows versions E88.10 and below. To exploit this vulne… |
CVE-2024-24910 | High | 7.3 | 2024-04-18 | A local attacker can erscalate privileges on affected Check Point ZoneAlarm ExtremeSecurity NextGen, Identity Agent for Windows, and Identity Agent for Windows… |
CVE-2023-28134 | High | 7.8 | 2023-11-12 | Local attacker can escalate privileges on affected installations of Check Point Harmony Endpoint/ZoneAlarm Extreme Security. An attacker must first obtain the… |
CVE-2023-28130 | High | 7.2 | 2023-07-26 | Local user may lead to privilege escalation using Gaia Portal hostnames page. |
CVE-2023-28133 | High | 7.8 | 2023-07-23 | Local privilege escalation in Check Point Endpoint Security Client (version E87.30) via crafted OpenSSL configuration file |
CVE-2022-23746 | High | 7.5 | 2022-11-30 | The IPsec VPN blade has a dedicated portal for downloading and connecting through SSL Network Extender (SNX). If the portal is configured for username/password… |
CVE-2022-41604 | High | 8.8 | 2022-09-27 | Check Point ZoneAlarm Extreme Security before 15.8.211.19229 allows local users to escalate privileges. This occurs because of weak permissions for the %PROGRA… |
CVE-2022-23745 | High | 7.5 | 2022-07-18 | A potential memory corruption issue was found in Capsule Workspace Android app (running on GrapheneOS). This could result in application crashing but could not… |
CVE-2022-23744 | Low | 2.3 | 2022-07-07 | Check Point Endpoint before version E86.50 failed to protect against specific registry change which allowed to disable endpoint protection by a local administr… |
CVE-2022-23742 | High | 7.8 | 2022-05-12 | Check Point Endpoint Security Client for Windows versions earlier than E86.40 copy files for forensics reports from a directory with low privileges. An attacke… |
CVE-2021-30361 | Medium | 6.7 | 2022-05-11 | The Check Point Gaia Portal's GUI Clients allowed authenticated administrators with permission for the GUI Clients settings to inject a command that would run… |
CVE-2022-23743 | High | 7.8 | 2022-05-11 | Check Point ZoneAlarm before version 15.8.200.19118 allows a local actor to escalate privileges during the upgrade process. In addition, weak permissions in th… |
CVE-2021-30360 | High | 7.8 | 2022-01-10 | Users have access to the directory where the installation repair occurs. Since the MS Installer allows regular users to run the repair, an attacker can initiat… |
CVE-2021-30359 | High | 7.8 | 2021-10-22 | The Harmony Browse and the SandBlast Agent for Browsers installers must have admin privileges to execute some steps during the installation. Because the MS Ins… |
CVE-2021-30358 | High | 7.2 | 2021-10-19 | Mobile Access Portal Native Applications who's path is defined by the administrator with environment variables may run applications from other locations by the… |
CVE-2021-30357 | Medium | 5.3 | 2021-06-08 | SSL Network Extender Client for Linux before build 800008302 reveals part of the contents of the configuration file supplied, which allows partially disclosing… |
CVE-2021-30356 | High | 8.1 | 2021-04-22 | A denial of service vulnerability was reported in Check Point Identity Agent before R81.018.0000, which could allow low privileged users to overwrite protected… |
CVE-2021-3449 | Medium | 5.9 | 2021-03-25 | An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the… |
CVE-2020-6024 | High | 7.8 | 2021-01-20 | Check Point SmartConsole before R80.10 Build 185, R80.20 Build 119, R80.30 before Build 94, R80.40 before Build 415, and R81 before Build 548 were vulnerable t… |
CVE-2020-6021 | High | 7.8 | 2020-12-03 | Check Point Endpoint Security Client for Windows before version E84.20 allows write access to the directory from which the installation repair takes place. Sin… |
CVE-2020-6015 | Medium | 5.5 | 2020-11-05 | Check Point Endpoint Security for Windows before E84.10 can reach denial of service during clean install of the client which will prevent the storage of servic… |
CVE-2020-6014 | Medium | 6.5 | 2020-11-02 | Check Point Endpoint Security Client for Windows, with Anti-Bot or Threat Emulation blades installed, before version E83.20, tries to load a non-existent DLL d… |
CVE-2020-6023 | High | 7.8 | 2020-10-27 | Check Point ZoneAlarm before version 15.8.139.18543 allows a local actor to escalate privileges while restoring files in Anti-Ransomware. |
CVE-2020-6022 | Medium | 5.5 | 2020-10-27 | Check Point ZoneAlarm before version 15.8.139.18543 allows a local actor to delete arbitrary files while restoring files in Anti-Ransomware. |
CVE-2020-6020 | Medium | 6.4 | 2020-09-24 | Check Point Security Management's Internal CA web management before Jumbo HFAs R80.10 Take 278, R80.20 Take 160, R80.30 Take 210, and R80.40 Take 38, can be ma… |
CVE-2020-6012 | High | 7.4 | 2020-08-04 | ZoneAlarm Anti-Ransomware before version 1.0.713 copies files for the report from a directory with low privileges. A sophisticated timed attacker can replace t… |
CVE-2020-6013 | High | 8.8 | 2020-07-06 | ZoneAlarm Firewall and Antivirus products before version 15.8.109.18436 allow an attacker who already has access to the system to execute code at elevated priv… |
CVE-2019-8463 | High | 7.5 | 2019-12-23 | A denial of service vulnerability was reported in Check Point Endpoint Security Client for Windows before E82.10, that could allow service log file to be writt… |
CVE-2019-8462 | High | 7.5 | 2019-10-02 | In a rare scenario, Check Point R80.30 Security Gateway before JHF Take 50 managed by Check Point R80.30 Management crashes with a unique configuration of enha… |
CVE-2019-8461 | High | 7.8 | 2019-08-29 | Check Point Endpoint Security Initial Client for Windows before version E81.30 tries to load a DLL placed in any PATH location on a clean image without Endpoin… |
CVE-2019-8459 | Critical | 9.8 | 2019-06-20 | Check Point Endpoint Security Client for Windows, with the VPN blade, before version E80.83, starts a process without using quotes in the path. This can cause… |
CVE-2019-8458 | Medium | 4.4 | 2019-06-20 | Check Point Endpoint Security Client for Windows, with Anti-Malware blade installed, before version E81.00, tries to load a non-existent DLL during an update i… |
CVE-2019-8454 | High | 7.0 | 2019-04-29 | A local attacker can create a hard-link between a file to which the Check Point Endpoint Security client for Windows before E80.96 writes and another BAT file… |
CVE-2019-8452 | High | 7.8 | 2019-04-22 | A hard-link created from log file archive of Check Point ZoneAlarm up to 15.4.062 or Check Point Endpoint Security client for Windows before E80.96 to any file… |
CVE-2019-8455 | High | 7.1 | 2019-04-17 | A hard-link created from the log file of Check Point ZoneAlarm up to 15.4.062 to any file on the system will get its permission changed so that all users can a… |
CVE-2019-8453 | Medium | 5.5 | 2019-04-17 | Some of the DLLs loaded by Check Point ZoneAlarm up to 15.4.062 are taken from directories where all users have write permissions. This can allow a local attac… |
CVE-2019-8456 | Medium | 5.9 | 2019-04-09 | Check Point IKEv2 IPsec VPN up to R80.30, in some less common conditions, may allow an attacker with knowledge of the internal configuration and setup to succe… |
CVE-2018-8790 | High | 7.8 | 2019-03-01 | Check Point ZoneAlarm version 15.3.064.17729 and below expose a WCF service that can allow a local low privileged user to execute arbitrary code as SYSTEM. |
CVE-2014-8952 | | 2014-11-16 | Multiple unspecified vulnerabilities in Check Point Security Gateway R75.40VS, R75.45, R75.46, R75.47, R76, R77, and R77.10, when the (1) IPS blade, (2) IPsec… | |
CVE-2014-8951 | | 2014-11-16 | Unspecified vulnerability in Check Point Security Gateway R75, R76, R77, and R77.10, when UserCheck is enabled and the (1) Application Control, (2) URL Filteri… | |
CVE-2014-8950 | | 2014-11-16 | Unspecified vulnerability in Check Point Security Gateway R77 and R77.10, when the (1) URL Filtering or (2) Identity Awareness blade is used, allows remote att… | |
CVE-2014-7169 | Critical | 9.8 | 2014-09-25 | GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows re… |
CVE-2014-6271 | Critical | 9.8 | 2014-09-24 | GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arb… |
CVE-2013-7350 | | 2014-04-01 | Multiple unspecified vulnerabilities in Check Point Security Gateway 80 R71.x before R71.45 (730159141) and R75.20.x before R75.20.4 and 600 and 1100 appliance… | |
CVE-2014-1673 | | 2014-01-26 | Check Point Session Authentication Agent allows remote attackers to obtain sensitive information (user credentials) via unspecified vectors. | |
CVE-2014-1672 | | 2014-01-26 | Check Point R75.47 Security Gateway and Management Server does not properly enforce Anti-Spoofing when the routing table is modified and the "Get - Interfaces… | |
CVE-2013-7311 | | 2014-01-23 | The OSPF implementation in Check Point Gaia OS R75.X and R76 and IPSO OS 6.2 R75.X and R76 does not consider the possibility of duplicate Link State ID values… | |
CVE-2013-7304 | | 2014-01-22 | Check Point Endpoint Security MI Server through R73 3.0.0 HFA2.5 does not configure X.509 certificate validation for client devices, which allows man-in-the-mi… | |
CVE-2013-5636 | | 2013-11-30 | Unlock.exe in Media Encryption EPM Explorer in Check Point Endpoint Security through E80.50 does not associate password failures with a device ID, which makes… | |
CVE-2013-5635 | | 2013-11-30 | Media Encryption EPM Explorer in Check Point Endpoint Security through E80.50 does not properly maintain the state of password failures, which makes it easier… | |
CVE-2010-5184 | | 2012-08-25 | Race condition in ZoneAlarm Extreme Security 9.1.507.000 on Windows XP allows local users to bypass kernel-mode hook handlers, and execute dangerous code that… | |
CVE-2012-2753 | | 2012-06-19 | Untrusted search path vulnerability in TrGUI.exe in the Endpoint Connect (aka EPC) GUI in Check Point Endpoint Security R73.x and E80.x on the VPN blade platfo… | |
CVE-2011-1827 | | 2011-10-05 | Multiple unspecified vulnerabilities in Check Point SSL Network Extender (SNX), SecureWorkSpace, and Endpoint Security On-Demand, as distributed by SecurePlatf… | |
CVE-2011-2664 | | 2011-07-08 | Unspecified vulnerability in Check Point Multi-Domain Management / Provider-1 NGX R65, R70, R71, and R75, and SmartCenter during installation on non-Windows ma… | |
CVE-2008-7025 | | 2009-08-21 | TrueVector in Check Point ZoneAlarm 8.0.020.000, with vsmon.exe running, allows remote HTTP proxies to cause a denial of service (crash) and disable the HIDS m… | |
CVE-2008-7009 | | 2009-08-19 | Buffer overflow in multiscan.exe in Check Point ZoneAlarm Security Suite 7.0.483.000 and 8.0.020.000 allows local users to execute arbitrary code via a file or… | |
CVE-2009-1227 | | 2009-04-02 | NOTE: this issue has been disputed by the vendor. Buffer overflow in the PKI Web Service in Check Point Firewall-1 PKI Web Service allows remote attackers to… | |
CVE-2008-5994 | | 2009-01-28 | Cross-site scripting (XSS) vulnerability in index.php in Check Point Connectra NGX R62 HFA_01 allows remote attackers to inject arbitrary web script or HTML vi… | |
CVE-2008-5849 | | 2009-01-06 | Check Point VPN-1 R55, R65, and other versions, when Port Address Translation (PAT) is used, allows remote attackers to discover intranet IP addresses via a pa… | |
CVE-2008-1397 | | 2008-03-20 | Check Point VPN-1 Power/UTM, with NGX R60 through R65 and NG AI R55 software, allows remote authenticated users to cause a denial of service (site-to-site VPN… | |
CVE-2008-1208 | | 2008-03-08 | Cross-site scripting (XSS) vulnerability in the login page in Check Point VPN-1 UTM Edge W Embedded NGX 7.0.48x allows remote attackers to inject arbitrary web… | |
CVE-2008-0662 | High | 7.8 | 2008-02-08 | The Auto Local Logon feature in Check Point VPN-1 SecuRemote/SecureClient NGX R60 and R56 for Windows caches credentials under the Checkpoint\SecuRemote regist… |
CVE-2007-4216 | | 2007-08-21 | vsdatant.sys 6.5.737.0 in Check Point Zone Labs ZoneAlarm before 7.0.362 allows local users to gain privileges via a crafted Interrupt Request Packet (Irp) in… | |
CVE-2007-3489 | | 2007-06-29 | Cross-site request forgery (CSRF) vulnerability in pop/WizU.html in the management interface in Check Point VPN-1 Edge X Embedded NGX 7.0.33x on the Check Poin… | |
CVE-2007-2730 | | 2007-05-16 | Check Point ZoneAlarm Pro before 6.5.737.000 does not properly test for equivalence of process identifiers for certain Microsoft Windows API functions in the N… | |
CVE-2007-2689 | | 2007-05-16 | Check Point Web Intelligence does not properly handle certain full-width and half-width Unicode character encodings, which might allow remote attackers to evad… | |
CVE-2007-2174 | | 2007-04-24 | The IOCTL handling in srescan.sys in the ZoneAlarm Spyware Removal Engine (SRE) in Check Point ZoneAlarm before 5.0.156.0 allows local users to execute arbitra… | |
CVE-2007-0471 | | 2007-01-24 | sre/params.php in the Integrity Clientless Security (ICS) component in Check Point Connectra NGX R62 3.x and earlier before Security Hotfix 5, and possibly VPN… | |
CVE-2006-3885 | | 2006-07-27 | Directory traversal vulnerability in Check Point Firewall-1 R55W before HFA03 allows remote attackers to read arbitrary files via an encoded .. (dot dot) in th… | |
CVE-2006-0255 | | 2006-01-18 | Unquoted Windows search path vulnerability in Check Point VPN-1 SecureClient might allow local users to gain privileges via a malicious "program.exe" file in t… | |
CVE-2005-2932 | | 2005-12-31 | Multiple Check Point Zone Labs ZoneAlarm products before 7.0.362, including ZoneAlarm Security Suite 5.5.062.004 and 6.5.737, use insecure default permissions… | |
CVE-2005-4093 | | 2005-12-08 | Check Point VPN-1 SecureClient NG with Application Intelligence R56, NG FP1, 4.0, and 4.1 allows remote attackers to bypass security policies by modifying the… | |
CVE-2005-3673 | | 2005-11-18 | The Internet Key Exchange version 1 (IKEv1) implementation in Check Point products allows remote attackers to cause a denial of service via certain crafted IKE… |