ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode
Vendor

NHS England Digital

1 mentions in 7 days · 1 in 30 days · 2 total · first seen · last

Search everything

Timeline

Critical Check Point Management Flaw Lets Unauthenticated Attackers Run Code as Root

Check Point patched CVE-2026-91843 (CVSS 9.8), a pre-authentication stack overflow letting unauthenticated attackers run code as root on Security Management and Log Servers.

CVE-2026-91843 (CVSS 9.8) is a stack overflow in the pre-authentication login process of Check Point Security Management and Log Servers, reachable through the Trusted Clients setting. Check Point shipped a fix via LivePatch advisory sk1000155 and says there is no indication of exploitation; CISA also lists exploitation as none and no public PoC exists as of September 16. Affected branches span R80 through R82.20 (including end-of-support releases), and Censys observes 3,836 hosts presenting Check Point management identities. It is the fifth critical unauthenticated management flaw since July 22; the earlier SmartConsole bypass CVE-2026-16232 was exploited in July.

The Hacker Newsupdated · 3h agofirst · 19h agoVulnerability 10 sourcesCVE-2026-91843CVE-2026-16232

Attackers exploit critical SharePoint flaw after PoC goes public (CVE-2026-55040)

Attackers use Rapid7's public PoC to exploit CVE-2026-55040, a critical SharePoint authentication bypass patched in July 2026.

Rapid7 researcher Stephen Fewer published technical analysis and PoC exploit code for CVE-2026-55040, an authentication bypass in SharePoint caused by flaws in the JWT token validation pipeline. Threat intelligence firm Defused observed attackers using the PoC against SharePoint honeypots, though Microsoft has not yet confirmed in-the-wild exploitation. Chained with CVE-2026-63520, the flaw can yield unauthenticated remote code execution, per NHS England Digital. CISA is urging administrators to harden SharePoint deployments by limiting direct internet exposure and using Layer 7 reverse proxies.

Help Net Security · Aug 13, 2026Exploit / PoC in the wildCVE-2026-55040CVE-2026-63520

Related CVEs

  • CVE-2026-162329.372%
    Authentication Bypass in Check Point SmartConsole Grants Full Admin Access
    Check Point SmartConsole, the administrative client used to manage Quantum Security Management and Multi-Domain Security Management, contains an authentication bypass (CWE-287) in its login process that allows an unauthenticated remote attacker to obtain an application login token and authenticate with full administrative privileges. Exploitation is possible when the Management Server IP address is reachable from the internet and the configuration does not restrict Trusted Clients. A successful attacker can modify security policies and security configurations, effectively taking control of firewall management. Any organization running an internet-exposed Check Point management server without Trusted Client restrictions is affected, though Check Point reports exploitation has impacted only a very small number of customers. The flaw was added to CISA's KEV on 2026-07-22, is actively exploited, and press reports indicate public proof-of-concept code has been released.
    · Check Point SmartConsole · Check Point Quantum Security Management KEVlarge
  • CVE-2026-550409.151%
    Authentication Bypass in Microsoft SharePoint Server
    Microsoft SharePoint Server is affected by a weak authentication vulnerability (CWE-1390) that allows an unauthorized attacker to bypass a security feature over a network. Per the CVSS vector, exploitation requires no privileges and no user interaction with low attack complexity, so any unauthenticated attacker with network access to a vulnerable server can trigger it remotely. Impact to confidentiality and integrity is rated high (CVSS 9.1, critical), meaning the bypass effectively grants the attacker access that authentication should have prevented, with no direct availability impact. All organizations running on-premises Microsoft SharePoint Server are potentially affected; the source data does not specify affected version ranges or fixed builds, so defenders should consult Microsoft's advisory for those details. The flaw is under active exploitation: a public proof-of-concept is available on GitHub, attackers began exploiting it after the PoC went public, and CISA added it to the Known Exploited Vulnerabilities catalog on 2026-08-18 (EPSS ~40%, 99th percentile; ransomware association unknown).
    · Microsoft SharePoint Server KEV PoC ×2mass
  • CVE-2026-918439.8—
    Unauthenticated stack overflow gives root RCE in Check Point login process
    CVE-2026-91843 is a stack-based buffer overflow (CWE-121) in the unauthenticated login process of a Check Point product, as Check Point Software ([email protected]) is the assigning CNA and its CVE scope covers Check Point products. An attacker can trigger the flaw remotely by sending crafted input to the login interface before authenticating, with no user interaction or credentials required. Successful exploitation allows arbitrary code execution with root privileges, the highest level of control on the affected system. The vulnerability is rated 9.8 Critical (AV:N/AC:L/PR:N/UI:N, all impacts high), reflecting trivial network exploitability. No public proof-of-concept or confirmed in-the-wild exploitation is known at this time, and the source data does not name the specific product line or affected version ranges.
    · Check Point—
  • CVE-2026-635208.13%
    Unauthenticated RCE in Microsoft SharePoint Server
    CVE-2026-63520 is an improper input validation flaw (CWE-20) in Microsoft Office SharePoint, affecting on-premises SharePoint Server deployments. A remote, unauthenticated attacker can trigger the flaw by sending improperly validated input to the SharePoint service over the network; the high attack complexity (AC:H) indicates exploitation depends on specific conditions, but no privileges or user interaction are required. Successful exploitation results in arbitrary code execution on the server, with high impact to confidentiality, integrity, and availability — effectively full compromise of the SharePoint host. Organizations running self-hosted SharePoint Server are in scope; SharePoint Online/Microsoft 365 is not listed in the affected products. The issue is patched as of Microsoft's Patch Tuesday (headlines mark it FIXED), with Rapid7 analysis and a researcher-disclosed exploit chain available, but there is no public PoC, no CISA KEV listing, and no confirmed in-the-wild exploitation; EPSS puts exploitation probability at 2.9% (86th percentile).
    · Microsoft SharePoint Server (Office SharePoint, on-premises)mass

Appears with

vendor CISA 2organization Check Point 1organization CISA 1organization Defused 1organization NHS England Digital 1product Log Server 1product Security Management Server 1product SharePoint 1product SmartConsole 1vendor Censys 1vendor Check Point 1vendor Microsoft 1organization Censys 1vendor Rapid7 1
Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.