Vulnerabilidades de Checkpoint
CVEs publicadas que afetam produtos de Checkpoint: 20 registro(s), com severidade, exploração e correções.
Quantum Security Gateway 8Quantum Security Management 3Gaia Os 2Gaia Embedded 2Spark Firewalls 2Multi-domain Security Management 2Quantum Security Gateway Firmware 2Identity Agent 2Security Gateway 2Hramony SASE 1Identity Awareness 1Multi-domain Management Firmware 1Quantum Security Management Firmware 1WinRAR 1Check Point Quantum Gateway, Spark Gateway and CloudGuard Network 1Cloudguard Network Security 1Quantum Spark Firmware 1
CVE-2026-93616
Crítica · 9.8
KEV Urgente · 73 Exploit público CWE-22 22/09/2026
Check Point Multiple Products Path Traversal Vulnerability
A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on Check Point Management Server.
CVE-2026-85102
Crítica · 9.8
KEV Alta · 68 Exploit público CWE-295 09/09/2026
Check Point Multiple Products Improper Certificate Validation Vulnerability
Improper certificate trust validation during VPN negotiation in Check Point Quantum Security Gateway may allow an unauthenticated remote attacker to execute arbitrary code on the Gateway.
CVE-2026-16232
Crítica · 9.8
KEV Urgente · 83 Exploit público CWE-287 22/07/2026
Check Point SmartConsole Improper Authentication Vulnerability
An authentication bypass vulnerability in the Check Point SmartConsole login process allows an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges. Successful exploitation allows the attacker to modify security policies and security configurations. Remote exploitation requires internet access to the Management Server IP address and a configuration that does not restrict Trusted Clients. Check Point is aware that this vulnerability is being exploited and has affected a very small number of customers.
CVE-2026-10847
Alta · 7.8
CWE-427 11/06/2026
Local Privilege Escalation vulnerability in Check Point Identity Agent Full for Windows OS
A local privilege escalation vulnerability exists in Check Point Identity Agent Full for Windows OS. An authenticated local user may be able to execute arbitrary code with SYSTEM privileges due to improper handling of executable resolution during the log collection process. Successful exploitation could allow an attacker to gain elevated privileges on the affected Windows endpoint.
CVE-2026-50752
Alta · 7.4
CWE-295 08/06/2026
Certificate Validation Bypass in VPN Site-to-Site Connections Using IKEv1
A weakness in the certificate validation logic of the deprecated IKEv1 key exchange may allow an unauthenticated attacker positioned as a man-in-the-middle to bypass certificate validation in VPN site-to-site connections that use certificate-based authentication. Successful exploitation could allow interception or modification of traffic traversing the VPN tunnel.
CVE-2026-50751
Crítica · 9.3
KEV Urgente · 83 Exploit público Ransomware CWE-287 08/06/2026
Check Point Security Gateway Improper Authentication Vulnerability
A logic flow weakness in Remote Access and Mobile Access certificate validation in deprecated IKEv1 key exchange allows an unauthenticated remote attacker to bypass user authentication and establish a remote access VPN connection without a valid user password.
CVE-2026-48136
Média · 4.1
CWE-89 26/05/2026
Authenticated Administrator Role-Based Access Control Bypass in Compliance
When Compliance is enabled on Check Point Multi-Domain Management, an authenticated administrator with read-write access to one Management Domain (CMA) can modify stored metadata associated with Compliance Best Practices in another Management Domain, where the administrator has no access permissions, bypassing Role-Based Access Control (RBAC).
CVE-2026-48135
Média · 5.3
CWE-122 26/05/2026
HTTP service can incorrectly process malformed HTTP requests
A Check Point HTTP-based service can incorrectly handle malformed HTTP requests.
The issue is related to HTTP request parsing and validation.
CVE-2026-48134
Média · 5.6
CWE-89 26/05/2026
SQL injection issue in UserCheck Portal when DLP Software Blade is active
When the DLP is active, the UserCheck Web Portal contains an input-handling issue in the UserChoice flow. Under specific conditions, an attacker who can access the UserCheck Ask page could attempt to manipulate the Security Gateway's stored DLP/UserCheck incident information. This could lead to disruptions such as loss of stored incident entries, incorrect handling of pending approvals, or resource impact if the issue is abused repeatedly.
Exposure is reduced if the UserCheck Portal is not accessible from untrusted networks.
CVE-2026-48133
Alta · 7.5
CWE-98 26/05/2026
Identity Awareness Captive Portal - Unauthenticated Local File Inclusion
When the Identity Awareness blade is enabled with Browser-Based Authentication, an unauthenticated user may be able to read certain internal files on the Security Gateway.
CVE-2026-48132
Alta · 8.1
CWE-125 26/05/2026
VPN service may restart unexpectedly when processing IKE traffic over NAT-T 4500/UDP
The Security Gateway does not correctly validate a length value in certain IKE packets when NAT-T is used (4500/UDP). As a result, a specially crafted or malformed packet can cause the VPN processing service to terminate unexpectedly, leading to denial of service (temporary interruption of VPN negotiations/traffic).
CVE-2026-48131
Alta · 8.1
CWE-122 26/05/2026
VPND IKE Fragment Reassembly - Heap Out-of-Bounds Write via Sequence Number Zero
The VPN service may mishandle an unexpected IKE fragment value received on the IKE port 500/UDP during the early stage of a connection attempt. This can cause the service to terminate unexpectedly, resulting in denial of service (temporary disruption of VPN-related functionality).
CVE-2025-9142
Alta · 7.5
CWE-22 14/01/2026
Local privilege escalation in Harmony SASE Windows Agent
A local user can trigger Harmony SASE Windows client to write or delete files outside the intended certificate working directory.
CVE-2025-8305
Média · 6.5
CWE-200 22/12/2025
Information Disclosure in Identity Agent Debug Files
An authenticated local user can obtain information that allows claiming security policy rules of another user due to sensitive information being printed in plaintext in Identity Agent for Terminal Services debug files.
CVE-2025-8304
Média · 6.5
CWE-200 22/12/2025
Information Disclosure in Identity Agent Registry Keys
An authenticated local user can obtain information that allows claiming security policy rules of another user due to sensitive information being accessible in the Windows Registry keys for Check Point Identity Agent running on a Terminal Server.
CVE-2024-24919
Alta · 8.6
KEV Urgente · 89 Exploit público Ransomware CWE-200 28/05/2024
Check Point Quantum Security Gateways Information Disclosure Vulnerability
Potentially allowing an attacker to read certain information on Check Point Security Gateways once connected to the internet and enabled with remote Access VPN or Mobile Access Software Blades. A Security fix that mitigates this vulnerability is available.
CVE-2021-3449
Média · 5.9
CWE-476 25/03/2021
NULL pointer deref in signature_algorithms processing
An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension (where it was present in the initial ClientHello), but includes a signature_algorithms_cert extension then a NULL pointer dereference will result, leading to a crash and a denial of service attack. A server is only vulnerable if it has TLSv1.2 and renegotiation enabled (which is the default configuration). OpenSSL TLS clients are not impacted by this issue. All OpenSSL 1.1.1 versions are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1k. OpenSSL 1.0.2 is not impacted by this issue. Fixed in OpenSSL 1.1.1k (Affected 1.1.1-1.1.1j).
CVE-2018-20250
Alta · 7.8
KEV Urgente · 96 Exploit público Ransomware CWE-22 05/02/2019
WinRAR Absolute Path Traversal Vulnerability
In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field of the ACE format (in UNACEV2.dll). When the filename field is manipulated with specific patterns, the destination (extraction) folder is ignored, thus treating the filename as an absolute path.
CVE-2014-7169
Crítica · 9.8
KEV Urgente · 71 Exploit público CWE-78 24/09/2014
GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or possibly have unknown other impact via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271.
CVE-2014-6271
Crítica · 9.8
KEV Urgente · 83 Exploit público CWE-78 24/09/2014
GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution, aka "ShellShock." NOTE: the original fix for this issue was incorrect; CVE-2014-7169 has been assigned to cover the vulnerability that is still present after the incorrect fix.