#check-point

Analysis · May 20, 2026 · operations-desk

They read one file off the VPN gateway and left with your whole Active Directory

CVE-2024-24919 is filed as 'information disclosure.' On a Check Point gateway that meant unauthenticated file read, which meant password hashes, which meant ntds.dit within hours. It was a zero-day for a month before disclosure, and patching it doesn't undo the theft.