Vulnerabilities by vendor · updated on every deploy
Check Point vulnerabilities: exploited CVEs and our analysis
Check Point has 5 vulnerabilities in CISA's Known Exploited Vulnerabilities catalog, 4 of them added in the last 12 months and 2 known to be used in ransomware campaigns. Below: the 3 analyses Zero Hunt Research published on Check Point products, then the catalog entries newest first with the federal due date.
CISA catalog version 2026.10.21, released 2026-10-21 14:04 UTC.
5
CVEs in CISA KEV
4
Added in the last 12 months
2
Known ransomware use
3
Zero Hunt analyses
Products with the most KEV entries: Multiple Products (2) · Quantum Security Gateways (1) · Security Gateway (1) · SmartConsole (1)
Our analysis of Check Point vulnerabilities
2026-09-18
Check Point CVE-2026-91843: Pre-Auth Root on the Firewall Management ServerCVE-2026-91843 is a CVSS 9.8 pre-auth stack overflow that gives root on Check Point's Security Management Server. The real question is whether it's reachable from where an attacker lands.
2026-07-24
Check Point SmartConsole CVE-2026-16232: One Token to Rewrite Every Firewall RuleCVE-2026-16232 is a CVSS 9.3 authentication bypass in Check Point SmartConsole — an unauthenticated attacker takes an admin login token and rewrites your firewall policy. Exploited in the wild, KEV-listed.
2026-06-10
Check Point VPN Zero-Day CVE-2026-50751: When an IKEv1 Auth Bypass Leaves No Login to FindCheck Point CVE-2026-50751 opens a VPN session with no password via deprecated IKEv1. A Qilin affiliate used it for a month before the patch — leaving identity logs nothing to flag.
All 5 KEV entries
| Added | CVE | Product and vulnerability | Federal due date | Flags | Our analysis |
|---|---|---|---|---|---|
| 2026-09-22 | CVE-2026-93616 | Multiple Products Check Point Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent contain a path traversal vulnerability that allows an unauthenticated attacker to up… | 2026-09-25 | Forensic triage | — |
| 2026-09-22 | CVE-2026-85102 | Multiple Products Check Point Security Gateway and Check Point Spark Firewall using Site to Site VPN or Remote Access VPN contain an improper certificate validation vulnerability which could allow an unauthenticated remote attacker to… | 2026-09-25 | Forensic triage | — |
| 2026-07-22 | CVE-2026-16232 | SmartConsole Check Point SmartConsole contains an improper authentication vulnerability which could allow an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative… | 2026-07-25 | Forensic triage | Read → |
| 2026-06-08 | CVE-2026-50751 | Security Gateway Check Point Security Gateway contains an improper authentication vulnerability in IKEv1 key exchange that could allow an unauthenticated remote attacker to bypass user authentication and establish a remote access VPN… | 2026-06-11 | Ransomware | Read → |
| 2024-05-30 | CVE-2024-24919 | Quantum Security Gateways Check Point Quantum Security Gateways contain an unspecified information disclosure vulnerability. The vulnerability potentially allows an attacker to access information on Gateways connected to the internet, with IPS… | 2024-06-20 | Ransomware | — |
Source: CISA Known Exploited Vulnerabilities catalog (public data). Descriptions are CISA's, shortened. Always check the vendor advisory before acting. cisa.gov
Before you patch: three checks
- 01Match the exact version and configuration you run against the vendor advisory. Owning the product is not the same as being exposed.
- 02Check reachability: an exploited flaw on an interface reachable from the internet, or from a compromised workstation, moves to the front of the queue.
- 03Where CISA flags forensic triage, hunt for compromise as well as patch: a fix does not remove an attacker who got in before it.
Questions
How many Check Point vulnerabilities are in the CISA KEV catalog?
5 in catalog version 2026.10.21, the first added on 2024-05-30 and the most recent on 2026-09-22. 4 were added in the last 12 months.
Which Check Point products have the most exploited vulnerabilities?
By KEV entries: Multiple Products (2), Quantum Security Gateways (1), Security Gateway (1), SmartConsole (1).
Are Check Point vulnerabilities used in ransomware attacks?
CISA marks 2 of the 5 Check Point entries as known to be used in ransomware campaigns. The table flags them.
Is the next Check Point CVE exploitable on your network?
A KEV entry says a vulnerability is exploited somewhere. Zero Hunt answers whether it is exploitable in your environment: an autonomous AI red team on an on-premise appliance, running on private AI, black-box or gray-box, with a human approving every step that matters.
Other vendors: Cisco · Microsoft · Fortinet · Linux kernel · Citrix · GitLab · Adobe · Palo Alto Networks · Langflow · Arista · Oracle · SonicWall · Ivanti · VMware · Zimbra · SAP · Atlassian · Zyxel · Progress · F5