CVE-2025-3831 is a high severity flaw (CVSS 8.1) in Check Point Harmony SASE. Log files that the agent uploaded during troubleshooting may have been accessible to unauthorized parties. The record names no fixed version, so read Check Point's response, sk183761, for affected builds and the steps to take.
What's affected
The record names the Check Point Harmony SASE agent. The description says log files uploaded during troubleshooting may have been accessible to unauthorized parties. The record lists no affected or fixed versions.
Check Point published a response titled Check Point Response to CVE-2025-3831, Exposed SFTP server, under reference sk183761. That page is the vendor's own statement, and it is where the affected and fixed details should be confirmed.
The record lists the weakness as CWE-200 (exposure of sensitive information to an unauthorized actor) and CWE-798 (use of hard coded credentials). The CVSS 3.1 score is 8.1 (high), with the vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. The vector shows the flaw can be reached over the network, and no login is needed. Attack complexity is rated high, which holds the score down. Confidentiality impact is rated high, integrity high and availability high.
The record does not say this flaw is exploited in the wild, and the CISA Known Exploited Vulnerabilities flag is false. The vector rates attack complexity as high, which is why the score is 8.1 and not higher.
How to check if you're exposed
This is a vendor managed agent, so the advisory is the source of truth. A practical sequence follows.
- Open the Check Point advisory, sk183761, and read what it says about affected agent versions and any actions the vendor has already taken.
- Find out whether your organization uses Harmony SASE, and which agent version is on managed devices. The management console or your device inventory should show it.
- Ask your administrators whether anyone uploaded troubleshooting logs through the agent, and when.
- If logs were uploaded, review what they contain. Look for usernames, device names, internal addresses, tokens or other values that should not be shared.
This is an agent issue, not a code library issue, so a dependency scan will not show it. The Gold directory lets you look up related CVEs by product.
What to do now
- Read Check Point's advisory sk183761 and follow the actions it lists.
- Update the Harmony SASE agent to the version the advisory recommends, if it names one.
- List the troubleshooting log uploads your team made, and decide whether any contained sensitive values.
- Rotate credentials, tokens or keys that appeared in uploaded logs, if the advisory or your review suggests exposure.
- Add a rule that troubleshooting logs are reviewed and redacted before they leave a device.
- Record the finding in your vendor risk notes so the next review does not start from scratch.
Why it matters
Diagnostic logs are easy to forget. They are written for engineers, and they often hold more than the person uploading them realizes: names of users and machines, network details and sometimes secrets. When they go to a place that others can reach, the harm comes from what the logs say about your environment.
The record lists CWE-200, exposure of sensitive information, and CWE-798, use of hard coded credentials. The record does not explain how the two connect, so rely on the vendor advisory for the mechanism. What the pairing suggests is a reminder to check any shared upload path for fixed credentials and open access.
Quick check
Does the record say which versions are affected?
No. The record gives only a short description. Use Check Point's advisory, sk183761, for versions and remediation.
Is this a dependency problem?
No. It concerns a vendor agent and a service, so a dependency scan will not find it. Track it through the vendor advisory and your device inventory.
Sources
- Gold entry for CVE-2025-3831
- NVD record for CVE-2025-3831, published 2025-08-12, as summarized above
- Check Point advisory sk183761
Last reviewed: 18 October 2026.
