EUVD-2026-80699
GHSA-9r37-4rp3-mw4w
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Overflow triggers in the unauthenticated login path over the network with no interaction (AV:N/AC:L/PR:N/UI:N), yielding root code execution and full C/I/A loss.
Primary rating from Vendor (checkpoint).
CVSS VectorVendor: checkpoint
Lifecycle Timeline
2DescriptionCVE.org
A stack overflow during the unauthenticated login process may allow an attacker to run arbitrary code remotely with root privileges.
AnalysisAI
Unauthenticated remote code execution affects Check Point Quantum Security Management, where a stack-based buffer overflow is reachable through the login process before authentication completes. Because the flaw is triggered during the pre-authentication login path, a remote attacker with network reachability to the management server's login/administration service needs no credentials, no user interaction, and no non-default configuration, and the resulting code execution is described as running with root privileges - consistent with the CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions - remote unauthenticated exploitation against Check Point Quantum Security Management, because the overflow occurs within the login process BEFORE authentication completes, so no credentials, user interaction, or non-default configuration are needed. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine top-priority vulnerability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary action is to apply the vendor fix for Check Point Quantum Security Management as documented in Check Point support article SK1000155 (https://support.checkpoint.com/results/sk/sk1000155); the available data does not specify an exact fixed version number, so the fixed build must be taken from that advisory rather than assumed, and patch status is therefore best described as 'vendor advisory available, exact fix version not specified in the available data' - no vendor-released patch version is confirmed by the supplied references. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every Check Point Quantum Security Management instance under your control and immediately restrict network reachability to the login/administration service so that only trusted management networks, jump hosts, or VPN-connected administrators can connect - explicitly block any internet-facing or broadly routable exposure - and open a case with Check Point support to obtain the current hotfix or mitigation guidance. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Checkpoint
View allGNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
Potentially allowing an attacker to read certain information on Check Point Security Gateways once connected to the inte
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
backend/comics/comics-document.c (aka the comic book backend) in GNOME Evince before 3.24.1 allows remote attackers to e
Authentication bypass in the Check Point SmartConsole login process lets an unauthenticated remote attacker mint a valid
Authentication bypass in Check Point Quantum Security Gateway and Spark Firewalls allows unauthenticated remote attacker
Remote code execution in Check Point Quantum Security Gateway and Quantum Security Management stems from a heap-based bu
Remote code execution in Check Point Quantum Security Gateway arises from improper certificate trust validation during V
The huggingface/transformers library is vulnerable to arbitrary code execution through deserialization of untrusted data
PyTorch is a Python package that provides tensor computation. [CVSS 8.8 HIGH]
Check Point ZoneAlarm Extreme Security before 15.8.211.19229 allows local users to escalate privileges. Rated high sever
Remote code execution in PyTorch Lightning through 2.6.5 allows an attacker who can get a victim to load a malicious che
Same weakness CWE-121 – Stack-based Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today