Loading story…
Check Point disclosed that its remote access VPN solutions had been targeted in ongoing attacks and later confirmed the activity was tied to CVE-2024-24919, a vulnerability affecting multiple Quantum Gateway product lines. The flaw can allow unauthorized reading of certain firewall device information when VPN or Mobile Access functionality is enabled, and early observed exploitation involved older local accounts that still used password-only authentication.
Check Point released a hotfix after updating its advisory, but external researchers said the issue was more severe than first described, that exploitation was relatively simple, and that a proof-of-concept had been published. Reporting indicated exploitation may have been underway since at least 30 April 2024, prompting urgent guidance for organizations to patch exposed devices immediately, review whether internet-facing systems had already been compromised, and follow Check Point validation and remediation guidance.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
By 2024-05-30, external researchers reported that CVE-2024-24919 was more serious and easier to exploit than initially indicated, and a proof-of-concept exploit was published. They also highlighted early exploitation involving old local accounts using password-only authentication.
On 2024-05-28, Check Point updated its advisory to confirm the vulnerability as CVE-2024-24919 and issued a hotfix for affected Quantum Gateway product lines. The flaw allows unauthorized reading of certain firewall device information when VPN or mobile access functionality is enabled.
On 2024-05-27, Check Point disclosed that its remote access VPN solutions had been targeted by attack attempts in recent months and initially advised customers to disable potentially exposed configurations.
Security research reported that exploitation activity targeting what was later identified as CVE-2024-24919 had been occurring since at least 2024-04-30 against internet-exposed Check Point remote access VPN devices.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
kyberturvallisuuskeskus.fi
Open sourcekyberturvallisuuskeskus.fi
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Check Point disclosed active exploitation of **CVE-2026-50751**, a critical authentication bypass in Check Point VPN Remote Access, Mobile Access, and Spark firewalls under specific configurations. The flaw, rated **CVSS 9.3**, affects systems using the deprecated **IKEv1** key exchange path and allows a remote, unauthenticated attacker to establish a VPN session without a valid password. Check Point said suspicious activity was detected on June 4, with the earliest known attacks dating to early May and a rise in activity across multiple jurisdictions in early June; customers were urged to review logs back to May 7 and investigate indicators of compromise. The company linked at least one confirmed post-compromise intrusion to a **Qilin ransomware** affiliate, describing a financially motivated attack that used VPS infrastructure and likely relied on **Rclone** for data exfiltration, with possible use of the **Tox** protocol for communications. Reporting also noted attempts to retrieve malicious **ELF** payloads from attacker-controlled infrastructure and warned that related infrastructure may also be probing VPN flaws in products from **Palo Alto, Fortinet, and F5**. Check Point released hotfixes for CVE-2026-50751 and for **CVE-2026-50752**, a separate flaw that could enable man-in-the-middle attacks on site-to-site tunnels but had not been observed as weaponized; the vendor advised organizations to apply fixes or disable IKEv1 where possible.
Jun 29, 2026
WatchGuard has confirmed that its Firebox firewall devices are being actively targeted due to a critical remote code execution vulnerability, CVE-2025-32978, which allows unauthenticated attackers to execute arbitrary commands remotely. The flaw resides in the Fireware OS Internet Key Exchange (IKE) service and can be exploited if the device is accessible over the internet, potentially giving attackers full control of the firewall. WatchGuard has released emergency patches and indicators of compromise, urging customers to update their firmware immediately or apply temporary workarounds if patching is not possible. The vulnerability affects configurations involving mobile user VPN with IKEv2 and branch office VPNs using IKEv2, even if some configurations have been deleted but others remain. In response to evidence of active exploitation, CISA has added a WatchGuard Firebox vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, highlighting the significant risk such flaws pose to federal and enterprise networks. CISA's directive requires federal agencies to remediate these vulnerabilities by a set deadline and strongly encourages all organizations to prioritize patching to reduce exposure to cyberattacks. The inclusion in the KEV Catalog underscores the urgency for organizations to address these vulnerabilities as part of their ongoing vulnerability management practices.
Jun 29, 2026
A critical vulnerability, tracked as CVE-2025-9242, has been discovered in WatchGuard's Fireware OS, affecting a wide range of Firebox network security appliances. This flaw is an out-of-bounds write in the 'iked' process, which is responsible for handling IKEv2 VPN negotiations. The vulnerability allows remote attackers to execute arbitrary code on affected devices without authentication, posing a severe risk to organizations relying on these appliances for network security. The issue specifically impacts devices configured with mobile user VPNs or branch office VPNs using IKEv2 with dynamic gateway peers. Security researchers have demonstrated that attackers can exploit this bug by sending specially crafted IKEv2 packets during the IKE_SA_AUTH phase, triggering a buffer overflow in the ike2_ProcessPayload_CERT function. Once exploited, attackers can gain control of the instruction pointer, establish Python interactive shells over TCP, and escalate to a full Linux shell by remounting filesystems and deploying BusyBox binaries. The vulnerability has been assigned a CVSS score of 9.3, underscoring its critical nature. According to scans by The Shadowserver Foundation, nearly 76,000 Firebox appliances remain exposed and vulnerable on the public internet, with the highest concentrations in the United States, Germany, Italy, the United Kingdom, Canada, and France. Affected Fireware OS versions include 11.10.2 through 11.12.4_Update1, the entire 12.0 series up to 12.11.3, and the 2025.1 release, impacting both older and newer Firebox models. WatchGuard has released patches in versions 12.3.1_Update3, 12.5.13, 12.11.4, and 2025.1.1 to address the vulnerability. Devices running version 11.x are no longer supported and will not receive security updates, prompting the vendor to recommend upgrading to a supported version. For appliances configured only with Branch Office VPNs to static gateway peers, WatchGuard has provided documentation for securing connections as a temporary workaround. The vulnerability transforms trusted security appliances into potential entry points for attackers, threatening the integrity of network defenses. Organizations are urged to assess their Firebox deployments, prioritize patching, and review VPN configurations to mitigate the risk. The widespread exposure of vulnerable devices highlights the urgency of remediation efforts. WatchGuard's disclosure and the subsequent public scanning have brought significant attention to the issue, emphasizing the importance of timely patch management in network security infrastructure. Failure to address this vulnerability could result in unauthorized access, lateral movement, and compromise of sensitive internal networks. The incident serves as a stark reminder of the risks posed by critical flaws in security appliances and the need for continuous monitoring and rapid response.
Jun 29, 2026