VendorsEdge, Security
Check Point
Check Point Software makes Quantum security gateways, the Gaia operating system, SmartConsole management, Remote Access VPN and Harmony endpoint products.
- Response trend, 6 months
- Not enough history
- Open now
- None
- Latest incident
- 22 Sep 2026
- Incidents on record
- 4
Response to exploited bugs
80 range 70–90rank 7 of 10
Provisional 3 reviewed zero-days. Not enough yet for a firm grade.
Fixing privately reported bugs
Not rated. 1 private report on record. A grade needs at least 3.
What a grade means. B means the vendor met the public norm, such as a first fix within 7 days of the first public report or a private fix within 120 days. Taking half the norm time scores 92, an A. Taking twice the norm time scores 43, a D−. How grades work
Why these grades
Every clock starts at the first public report.
- Response to exploited bugs: B+ (80), provisional, from 3 reviewed zero-days in the last 36 months. Likely range 70 to 90.
- First fix within a day for all 3 zero-days.
- Every supported version fixed within a day for all 2 zero-days. 1 more has no public date for a fix to every version.
- First advisory within a day for all 3 zero-days.
- Fixing privately reported bugs: not rated, a grade needs 3 cases. Median 328 days from private report to ZDI's public advisory (1 case). 1 of 1 took longer than ZDI's 120-day deadline.
- 1 of 4 reviewed exploited bugs had a public fix before exploitation was reported. It does not count toward the response grade.
Response to exploited bugs: sub-scores
- Time to first advisory3 of 3 zero-days within a day85B+3 cases, low confidence, weight 20%
- Time to first fix3 of 3 zero-days within a day85B+3 cases, low confidence, weight 40%
- Time to fix all versions2 of 2 zero-days within a day83B+2 cases, low confidence, weight 30%
- OpennessNo machine-readable advisory feed listed. 1 of 1 advisories said the bug was exploited. 2 of 3 fixed zero-days with a public fix date for every version.47D7 cases, low confidence, weight 10%
Fixing privately reported bugs: sub-score
- Private fix speedMedian 328 days from private report to ZDI's public advisory (1 case)731 case, low confidence, not used for this vendor
Response fingerprint
Median of 3 graded zero-days. Vendor statement 0h, first fix 0h, all versions 0h.
Counts toward the response grade 3
- 22 Sep 2026Check Point Management Server pre-auth path traversal and file upload (exploited since July)
- 22 Jul 2026Check Point SmartConsole login authentication bypass via application token
- 8 Jun 2026Check Point Remote Access VPN authentication bypass in deprecated IKEv1
Not graded 1: n-days, unreviewed timelines and end-of-life products
- 9 Sep 2026Check Point Security Gateway and Spark VPN certificate validation flaw allowing pre-auth RCENot graded: n-day
- Vendor silent
- Vendor statement, no fix
- Fixed for some versions
- Open, no fix
- Open, partly fixed
- Fixed when disclosed
- Date only, no time of day
One row per exploited incident, newest first. A tick at the start means a fix existed when the bug went public.
Exploited incidents
4 in 24 months, 1 with known ransomware use, 75% exploited before a fix
| First report | Incident | CVSS | Silence | First fix | All fixed | Status | Grade |
|---|---|---|---|---|---|---|---|
| 22 Sep 2026 | Check Point Management Server pre-auth path traversal and file upload (exploited since July)CVE-2026-93616 | 9.8 | 0h | same day | same day | Fixed | Counts toward grade |
| 9 Sep 2026 | Check Point Security Gateway and Spark VPN certificate validation flaw allowing pre-auth RCECVE-2026-85102, CVE-2026-85103 | 9.8 | 0h | same day | not dated | Fixed | Not graded: n-day |
| 22 Jul 2026 | Check Point SmartConsole login authentication bypass via application tokenCVE-2026-16232 | 9.3 | 0h | same day | same day | Fixed | Counts toward grade |
| 8 Jun 2026 | Check Point Remote Access VPN authentication bypass in deprecated IKEv1CVE-2026-50751, CVE-2026-50752 | 9.3 | 0h | same day | not dated | Fixed | Counts toward grade |
Private reports
Median 328 days, 100% over 120 days, 0 published unpatched
Bugs reported privately to Check Point by ZDI or Project Zero.
| Published | Advisory | Product | Days from report to fix or to publication. Tick: ZDI's 120-day deadline. | Patch at publication |
|---|---|---|---|---|
| 31 Jul 2024 | ZDI-24-1036CVE-2024-6233 | ZoneAlarm Extreme Security | 328to publication | Yes |
Grade history
Response to exploited bugs: score at the end of each month.
Show as a table
| Month | Score | Grade |
|---|---|---|
| Nov 2025 | – | NR |
| Dec 2025 | – | NR |
| Jan 2026 | – | NR |
| Feb 2026 | – | NR |
| Mar 2026 | – | NR |
| Apr 2026 | – | NR |
| May 2026 | – | NR |
| Jun 2026 | – | NR |
| Jul 2026 | – | NR |
| Aug 2026 | – | NR |
| Sep 2026 | 81 | B+ |
| Oct 2026 | 80 | B+ |
Channels
Get Check Point's own alerts
- XCheck Point on XFollow the account and turn on notifications.
- BlogCheck Point blog RSSSubscribe to the security blog.
- Advisory pageCheck Point product advisories (SecureKnowledge sk articles)Check the advisory page. It has no push channel.
- Advisory pageCheck Point Research advisories (IPS protections)Check the advisory page. It has no push channel.
Grade B plus.