# cve.now: Checkpoint

The newest entries naming Checkpoint as an affected vendor (up to 200), of 33 in all, 5 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-93616](https://cve.now/CVE-2026-93616.md): Directory Traversal and File upload allows execution of arbitrary script on the Management Server (CVSS 9.8, KEV)
- [CVE-2026-91843](https://cve.now/CVE-2026-91843.md): Stack overflow in login process to the Security Management and Log Servers (CVSS 9.8)
- [CVE-2026-85103](https://cve.now/CVE-2026-85103.md): Heap-based Buffer Overflow in VPN Certificate ASN.1 Decoding (CVSS 9.8)
- [CVE-2026-85102](https://cve.now/CVE-2026-85102.md): Improper Certificate Validation in Quantum Security Gateway (CVSS 9.8, KEV)
- [CVE-2026-18574](https://cve.now/CVE-2026-18574.md): Authentication Bypass in Check Point Security Management Server (CVSS 9.3)
- [CVE-2026-62145](https://cve.now/CVE-2026-62145.md): Local Privilege Escalation in Gaia Portal (CVSS 7.5)
- [CVE-2026-62144](https://cve.now/CVE-2026-62144.md): Management Authentication Bypass and Privilege Escalation (CVSS 9.1)
- [CVE-2026-16232](https://cve.now/CVE-2026-16232.md): Authentication Bypass in the SmartConsole Login Process Using an Application Token (CVSS 9.3, KEV)
- [CVE-2026-10847](https://cve.now/CVE-2026-10847.md): Local Privilege Escalation vulnerability in Check Point Identity Agent Full for Windows OS (CVSS 7.8)
- [CVE-2026-50751](https://cve.now/CVE-2026-50751.md): User Authentication Bypass in VPN Remote Access and Mobile Access (CVSS 9.3, KEV)
- [CVE-2026-50752](https://cve.now/CVE-2026-50752.md): Certificate Validation Bypass in VPN Site-to-Site Connections Using IKEv1 (CVSS 7.4)
- [CVE-2026-48136](https://cve.now/CVE-2026-48136.md): Authenticated Administrator Role-Based Access Control Bypass in Compliance (CVSS 4.1)
- [CVE-2026-48135](https://cve.now/CVE-2026-48135.md): HTTP service can incorrectly process malformed HTTP requests (CVSS 5.3)
- [CVE-2026-48134](https://cve.now/CVE-2026-48134.md): SQL injection issue in UserCheck Portal when DLP Software Blade is active (CVSS 5.6)
- [CVE-2026-48133](https://cve.now/CVE-2026-48133.md): Identity Awareness Captive Portal - Unauthenticated Local File Inclusion (CVSS 7.5)
- [CVE-2026-48132](https://cve.now/CVE-2026-48132.md): VPN service may restart unexpectedly when processing IKE traffic over NAT-T 4500/UDP (CVSS 8.1)
- [CVE-2026-48131](https://cve.now/CVE-2026-48131.md): VPND IKE Fragment Reassembly - Heap Out-of-Bounds Write via Sequence Number Zero (CVSS 8.1)
- [CVE-2025-9142](https://cve.now/CVE-2025-9142.md): Local privilege escalation in Harmony SASE Windows Agent (CVSS 7.5)
- [CVE-2025-8305](https://cve.now/CVE-2025-8305.md): Information Disclosure in Identity Agent Debug Files (CVSS 6.5)
- [CVE-2025-8304](https://cve.now/CVE-2025-8304.md): Information Disclosure in Identity Agent Registry Keys (CVSS 6.5)
- [CVE-2025-3831](https://cve.now/CVE-2025-3831.md): Exposed SFTP server (CVSS 8.1)
- [CVE-2024-52885](https://cve.now/CVE-2024-52885.md): Path Traversal (CVSS 5.0)
- [CVE-2025-2028](https://cve.now/CVE-2025-2028.md): Lack of TLS validation (CVSS 6.5)
- [CVE-2024-24915](https://cve.now/CVE-2024-24915.md): SmartConsole Sensitive Credential Exposure via Memory Dump (CVSS 6.1)
- [CVE-2024-24916](https://cve.now/CVE-2024-24916.md): DLL-HiJacking (CVSS 6.5)
- [CVE-2024-52888](https://cve.now/CVE-2024-52888.md): Stored-XSS (CVSS 5.4)
- [CVE-2024-52887](https://cve.now/CVE-2024-52887.md): Self-XSS (CVSS 3.5)
- [CVE-2024-24911](https://cve.now/CVE-2024-24911.md): Out of Bounds read in the CPCA process on Check Point Management Server (CVSS 5.3)
- [CVE-2024-24914](https://cve.now/CVE-2024-24914.md): Authenticated Gaia users can inject code or commands by global variables through special HTTP requests. (CVSS 8.0)
- [CVE-2024-24919](https://cve.now/CVE-2024-24919.md): Information disclosure (CVSS 8.6, KEV)
- [CVE-2024-24912](https://cve.now/CVE-2024-24912.md): Local privilege escalation in Harmony Endpoint Security Client for Windows via crafted DLL file (CVSS 6.7)
- [CVE-2024-24910](https://cve.now/CVE-2024-24910.md): LocalprivilegeescalationinCheckPointZoneAlarmExtremeSecurityNextGen,IdentityAgentforWindows,andIdentityAgentforWindowsTerminalServerviacraftedDLLfile (CVSS 7.3)
- [CVE-2023-28134](https://cve.now/CVE-2023-28134.md): Local Privliege Escalation in Check Point Endpoint Security Remediation Service (CVSS 7.8)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/checkpoint
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.