Check Point Security Products Targeted in Active Exploit Campaign

How Attackers Are Turning Firewalls Into Attack Vectors

Check Point Software Technologies has confirmed that attackers are actively exploiting two critical vulnerabilities in its Security Gateway and Security Management solutions, turning network defense tools into potential entry points for breaches. The disclosure came after the company observed real-world attempts to compromise enterprise systems through flaws in its widely deployed firewall and security management platforms. The vulnerabilities, identified as CVE-2024-24919 and CVE-2024-24920, allow unauthenticated remote code execution under specific conditions, enabling attackers to bypass authentication and gain control over affected devices. Check Point urged customers to apply emergency patches immediately, noting that exploitation attempts have been detected across multiple industries and geographic regions.

The exploited flaws reside in the management interfaces of Check Point’s security appliances, where improper input validation allows malicious actors to inject and execute arbitrary code without needing valid credentials. Once inside, attackers can manipulate firewall rules, exfiltrate sensitive data, or move laterally within the network—undermining the very purpose of the security infrastructure. Researchers noted that the vulnerabilities are particularly dangerous because they affect devices often placed at the network perimeter, trusted by default, and rarely subjected to the same scrutiny as internal systems. Check Point emphasized that while patches are available, many organizations delay updates due to fears of service disruption, creating a window of opportunity for threat actors.

Why Are Security Tools Themselves Becoming Prime Targets?

As enterprises invest heavily in perimeter defenses, attackers have shifted focus to exploiting trust in security products, knowing that compromising a firewall or management server provides high-value access with minimal detection. This trend reflects a broader evolution in cyber threats, where adversaries no longer seek only to breach networks but to weaponize the tools designed to protect them. Check Point’s advisory highlights that the attacked components are not niche features but core elements of its security architecture, meaning widespread exposure if left unpatched. The company also noted that exploit attempts have increased in frequency since the vulnerabilities were disclosed, suggesting active interest from both criminal groups and state-linked actors.

What products are affected by the vulnerabilities? The flaws impact Check Point’s Security Gateway and Security Management blades, specifically versions prior to the latest patched releases. Organizations using these products should verify their version numbers and apply updates immediately.

Frequently Asked Questions

How can companies detect if they’ve been compromised? Check Point recommends reviewing logs for unusual administrative access, unexpected configuration changes, or outbound connections to unknown IP addresses. Deploying intrusion detection signatures provided by the vendor can also help identify active exploitation attempts.

Is there evidence of data theft linked to these exploits? While Check Point has not confirmed specific data breaches resulting from these vulnerabilities, it warns that successful exploitation could lead to full system compromise, making data exfiltration a significant risk that organizations must assume until proven otherwise.