Check Point

Check Point confirmed a December 2024 incident where compromised credentials for a portal account led to limited data exposure. The threat actor CoreInjection later claimed to sell stolen data, but Check Point states the exposed information was limited to account names, product names, employee emails, and three customer contacts, with no access to production systems or security architecture.

A zero-day path-traversal vulnerability in Check Point Quantum network security devices was actively exploited starting around April 30, 2024, allowing remote attackers to obtain sensitive credentials and gain network access. The flaw is described as 'extremely easy' to exploit and affects the very devices designed to protect corporate networks. Check Point has released patches and urged customers to apply them.

A denial-of-service vulnerability in multiple Windows EDR products allows a low-privileged user to permanently disable the agent after a reboot by preemptively registering an ALPC port name used by the EDR. The affected EDRs fail to handle the case where the port is already in use, causing user-mode components to crash or become non-functional. Kernel components remain running but lose detection/blocking capabilities in most cases.

A video and Reddit post surfaced on May 28, 2023, showing an executable that allegedly disables tamper protection and terminates the on-premise agents of numerous endpoint security products. The tool claims to work against vendors including CrowdStrike, SentinelOne, Carbon Black, and Windows Defender. ThreatLocker notes that its application allowlisting would block such an unknown executable from running.