Threat actors have been observed exploiting a high-severity zero-day vulnerability in Check Point Remote Access VPN since April 30, 2024. The flaw, tracked as CVE-2024-24919 (CVSS score: 7.5/10), affects various Network Security gateway products, including CloudGuard Network and Quantum appliances. This vulnerability allows attackers to read sensitive information on internet-connected gateways with remote access VPN or mobile access enabled. It enables attackers to extract password hashes from local accounts, leading to potential lateral movement within networks. Check Point has released hotfixes to mitigate the issue. The vulnerability is critical due to its low-complexity, ease of exploitation, and lack of required user interaction or privileges. Exploitation attempts have focused on stale VPN local accounts with weak password-only authentication, allowing attackers to misuse Active Directory (AD) data and move laterally within victim networks. CTIX analysts strongly advise administrators to apply patches, remove vulnerable local accounts, rotate LDAP connection passwords, and monitor for signs of compromise.