What’s Vulnerable › Vulnerabilities

CVE-2019-8459

• Severity: critical (CVSS 9.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2019-06-20 · updated 2026-06-17
• Weakness: CWE-428

Description

Check Point Endpoint Security Client for Windows, with the VPN blade, before version E80.83, starts a process without using quotes in the path. This can cause loading of a previously placed executable with a name similar to the parts of the path, instead of the intended one.

Affected products

• checkpoint Capsule Docs Standalone Client: before e80.82 — fixed in e80.82
• checkpoint Endpoint Security Clients: before e80.83 — fixed in e80.83
• checkpoint Endpoint Security Server Package: before r77.30.03 — fixed in r77.30.03
• checkpoint Jumbo Hotfix For Endpoint Security Server: before r77.30 — fixed in r77.30
• checkpoint Remote Access Clients: before e80.83 — fixed in e80.83
• checkpoint Smartconsole For Endpoint Security Server: before r77.30.03; e80.83 — fixed in r77.30.03

How to fix

Upgrade to a fixed version: checkpoint Capsule Docs Standalone Client e80.82; checkpoint Endpoint Security Clients e80.83; checkpoint Endpoint Security Server Package r77.30.03; checkpoint Jumbo Hotfix For Endpoint Security Server r77.30; checkpoint Remote Access Clients e80.83; checkpoint Smartconsole For Endpoint Security Server r77.30.03. Check the vendor advisory for mitigations.

References

• https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk124972#Resolved%20Issues
• https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk124972#Resolved%20Issues

Get alerted when CVE-2019-8459 or the next vulnerability affects your stack