Vendor scorecard
CISA lists 5 Check Point vulnerabilities as exploited in the wild, 4 of them added in the last 12 months (up from 0 in the 12 months before). 2 (40%) are known to be used in ransomware campaigns. For entries added in the last two years, the median time from CVE publication to the KEV listing was 0 days. Most affected: Multiple Products (2), SmartConsole (1), Security Gateway (1).
| Product | KEV entries |
|---|---|
| Multiple Products | 2 |
| SmartConsole | 1 |
| Security Gateway | 1 |
| Quantum Security Gateways | 1 |
| CVE | Vulnerability | Added |
|---|---|---|
| CVE-2026-93616 | Check Point Multiple Products Path Traversal VulnerabilityMultiple Products | |
| CVE-2026-85102 | Check Point Multiple Products Improper Certificate Validation VulnerabilityMultiple Products | |
| CVE-2026-16232 | Check Point SmartConsole Improper Authentication VulnerabilitySmartConsole | |
| CVE-2026-50751 | Check Point Security Gateway Improper Authentication VulnerabilityRANSOMWARESecurity Gateway | |
| CVE-2024-24919 | Check Point Quantum Security Gateways Information Disclosure VulnerabilityRANSOMWAREQuantum Security Gateways |
Get an email when CISA adds the next Check Point CVE.
How to read this: CISA KEV lists vulnerabilities with reliable evidence of exploitation; a vendor with many entries is often one with a large, internet-facing install base, not necessarily worse engineering. "Publication → KEV" is the median number of days between the CVE's publication and its addition to KEV, for entries added in the last 24 months (4 entries); it is an upper bound on how long defenders had, since exploitation usually starts before the listing. Under NIS2 article 21(2)(d), supplier security is part of your risk management; this page is a starting point for that review. Compare vendors on the scorecard index.
We assess supplier security for NIS2 and DORA, from exploited-CVE history and patch response to contract clauses and evidence packs.
Get in touch →