CheckPoint Identity Agent CVE-2025-8304

Exploitation requires the attacker to already be an authenticated local user with an interactive session on a Windows Terminal Server that is running the Check Point Identity Agent (the multi-user Terminal Server deployment mode is the specific prerequisite - this is not a single-user workstation scenario). The concrete technical condition is that sensitive identity/policy information is readable in the agent's Windows Registry keys by non-privileged users. Limiting factors that reduce real-world risk: there is no network vector (AV:L), the attacker must hold valid credentials/local access (PR:L), the host must be a shared Terminal Server with the Identity Agent installed, and at least one OTHER user's policy data must be present on the same host for the cross-user impact to be meaningful.

This is a moderate, not high-urgency, issue. The CVSS 3.1 base score is 6.5 (MEDIUM) with vector AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N - meaning exploitation requires LOCAL access and an authenticated low-privileged account (PR:L), not remote network reach. The elevated score is driven largely by the scope change (S:C), reflecting that one user can learn information enabling them to claim ANOTHER user's security policy rules, i.e. impact crosses a security boundary. Supporting exploitation signals are weak and consistent with each other: EPSS is only 0.12% (2nd percentile), there is no CISA KEV listing, and no public exploit identified at time of analysis. All signals align - low real-world exploitation probability, no active exploitation, local-only vector - so there is no conflict to reconcile here. This is best characterized as a genuine confidentiality/authorization weakness worth patching in Terminal Server multi-user environments, but not an emergency: it is a high-CVSS-feeling (scope change) but low-real-risk issue in practice because it is gated behind authenticated local access on a shared Terminal Server. The single vendor reference (Check Point sk184263) is behind a support portal and was not independently retrievable, so affected-version detail is not confirmed here.

A legitimate but low-privileged user logged into a shared Windows Terminal Server running the Check Point Identity Agent reads sensitive values stored in the agent's Windows Registry keys. Using that disclosed information, they impersonate or 'claim' the security policy rules assigned to a different user on the same server, gaining access aligned with that other identity. No public exploit code is known, so exploitation would require manual registry inspection by someone already authenticated on the host.