ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “Check Point Security Gateway”

105 items

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllVulnerability 109Malware 60Ransomware 54Exploit / PoC 46Data breach 33Threat actor 30Industry 19Phishing & fraud 17Policy & legal 11AI safety & security 7AI tools & infra 5Advisory 5AI industry 4Tools 4
SeverityAllcritical 172high 105medium 87low 21info 22

2026-012: Critical Vulnerabilities in Check Point Products

Check Point issued emergency hotfixes for two CVSS 9.8 flaws (CVE-2026-85102, CVE-2026-85103) enabling unauthenticated RCE on VPN-enabled gateways.

On 9 September 2026, Check Point released emergency security updates for CVE-2026-85102 (improper certificate-data validation in VPN negotiation) and CVE-2026-85103 (heap overflow in VPN certificate ASN.1 decoding), both CVSS 9.8, allowing unauthenticated remote code execution. The flaws affect Security Gateway, Security Management Server, and Spark Firewall deployments configured with Remote Access or Site-to-Site VPN, spanning versions R80 through R82.10. CERT-EU advisory 2026-012 urges immediate hotfix application, prioritizing internet-facing and perimeter appliances.

CERT-EU Advisoriesupdated · 12h agofirst · 6d agoVulnerability 9 sourcesCVE-2026-85102CVE-2026-85103

Critical Check Point VPN Vulnerabilities Enable Remote Code Execution Attacks

Check Point patched two critical VPN flaws, CVE-2026-85102 and CVE-2026-85103 (CVSS 9.8), allowing unauthenticated RCE on Security Gateways.

Check Point disclosed and patched two critical VPN vulnerabilities, CVE-2026-85102 (improper certificate trust validation, CWE-295) and CVE-2026-85103 (heap-based buffer overflow in ASN.1 certificate parsing, CWE-122), both rated CVSS 9.8 and exploitable for unauthenticated remote code execution under specific conditions. The flaws affect Security Gateway, Security Management Server, and Spark Firewall deployments on R81.20, R82, and R82.10 branches plus end-of-support versions such as R80.40 and R81, while R82.20 is not affected. Check Point reports no evidence of active exploitation or public PoC; Live Patch rollout began September 9, 2026, and administrators without it must install Jumbo Hotfix Accumulator builds (R82.10 Take 44+, R82 Take 126+, R81.20 Take 166+). For Site-to-Site VPN, restricting UDP ports 500 and 4500 to known peers serves as an interim workaround, but no mitigation exists for Remote Access VPN or Spark Firewalls.

Cyber Security Newsupdated · 12h agofirst · 6d agoVulnerability 9 sourcesCVE-2026-85102CVE-2026-85103CVE-2026-50751

NCSC Warns of Critical Check Point VPN Flaws as Large-Scale Exploitation Is Expected

Dutch NCSC warns of two critical CVSS 9.8 Check Point VPN flaws enabling unauthenticated remote code execution, urging immediate patching before mass exploitation.

The Dutch NCSC warned that CVE-2026-85102 and CVE-2026-85103, both rated 9.8 CVSS, allow unauthenticated remote attackers to execute arbitrary code on Check Point Quantum Security Gateway, Spark Firewall, and Security Management Server deployments when VPN is enabled. CVE-2026-85102 stems from improper certificate trust validation during VPN negotiation, while CVE-2026-85103 is a heap-based buffer overflow in ASN.1 certificate decoding. Check Point shipped emergency updates on September 9, 2026, including R82.10 Take 44, R82 Take 126, and R81.20 Take 166 or later, plus LivePatch for eligible systems. No public exploit code exists yet, but the NCSC rates exploitation likelihood high and recommends restricting UDP ports 500 and 4500 to known peers as a stopgap.

Cyber Security Newsupdated · 12h agofirst · 3d agoVulnerability 9 sourcesCVE-2026-85102CVE-2026-85103

Check Point Patches Critical VPN Vulnerabilities

Check Point patches two critical unauthenticated RCE flaws (CVE-2026-85102, CVE-2026-85103) in VPN gateways and firewalls; no exploitation observed.

Check Point released patches for CVE-2026-85102 and CVE-2026-85103, two critical vulnerabilities (CVSS 9.8) enabling unauthenticated remote code execution in products using VPN functionality. CVE-2026-85102 involves improper validation of certificate data during VPN negotiation, while CVE-2026-85103 is a heap overflow in the VPN certificate ASN.1 decoding flow. Updates cover versions R82.10, R82, and R81.20; manually defining VPN rules is offered as a mitigation, though it does not apply to locally managed Spark Firewall instances. Check Point discovered both flaws internally and reports no evidence of exploitation in the wild.

SecurityWeekupdated · 12h agofirst · 5d agoVulnerability 9 sourcesCVE-2026-85102CVE-2026-85103CVE-2026-16232+1 CVEs1

Check Point Discloses Two 9.8-Rated VPN Certificate Flaws Enabling Unauthenticated RCE

Check Point patched two 9.8-rated VPN certificate flaws, CVE-2026-85102 and CVE-2026-85103, enabling unauthenticated remote code execution; no exploitation observed yet.

Check Point disclosed and began patching two critical (CVSS 9.8) vulnerabilities in VPN certificate handling on September 9: CVE-2026-85102, a certificate trust validation failure in VPN negotiation on Security Gateways, and CVE-2026-85103, a heap-based buffer overflow in ASN.1 decoding affecting Quantum Security Gateways and Security Management Server. Affected branches include R81.20, R82, and R82.10 Jumbo Hotfix levels; fixes ship via Live Patch or the latest Jumbo Hotfix. The company found both internally and reports no evidence of exploitation; the Canadian Centre for Cyber Security also published an advisory listing Spark firewalls.

The Hacker Newsupdated · 12h agofirst · 6d agoVulnerability 9 sourcesCVE-2026-85102CVE-2026-85103CVE-2026-50751+1 CVEs

Check Point security advisory (AV26-902)

Canada's Cyber Centre issued advisory AV26-902 warning of two Check Point RCE flaws, including VPN authentication bypass CVE-2026-85102.

The Canadian Centre for Cyber Security released advisory AV26-902 on September 9, 2026, covering vulnerabilities in Check Point Security Gateway, Spark Firewall with Site-to-Site or Remote Access VPN, and Security Management Server across multiple versions. CVE-2026-85102 is an authentication bypass and remote code execution flaw in Remote Access and Site-to-Site VPN, while CVE-2026-85103 is an ASN.1 decoding heap overflow enabling remote code execution. Administrators are urged to review the linked advisories and apply updates as they become available.

Canadian Centre for Cyber Security · 7d agoAdvisoryCVE-2026-85102CVE-2026-85103

Dutch NCSC: Critical Check Point VPN flaws exploitation is imminent

Dutch NCSC warns exploitation is imminent for critical Check Point VPN RCE flaws CVE-2026-85102 and CVE-2026-85103, urging immediate patching of Security Gateways.

The Dutch NCSC assesses the likelihood and impact of exploitation as high for two critical Check Point VPN flaws, though no public PoC exploit has been reported. CVE-2026-85102 is improper validation of certificate data during VPN negotiation, and CVE-2026-85103 is a heap overflow in the VPN certificate ASN.1 decoder; both enable remote code execution on Security Gateways, the latter also on Security Management Servers. Affected releases span R81.20, R82, R82.10, R81.10.x, R82.00.x and EoS versions R80 through R81.10, while R82.20 is unaffected. Check Point shipped fixes on September 9 via LivePatch Take 24 and Jumbo Hotfix Accumulator takes, and NCSC advises restricting Site-to-Site VPN rules to trusted IPs.

BleepingComputerupdated · 12h agofirst · 4d agoVulnerability 9 sourcesCVE-2026-85102CVE-2026-851032

Critical Check Point VPN Flaws Let Unauthenticated Attackers Execute Remote Code

Check Point fixed critical unauthenticated RCE flaws CVE-2026-85102 and CVE-2026-85103 in its VPN gateways; no exploitation observed yet.

Check Point disclosed two critical vulnerabilities affecting Remote Access VPN and Site-to-Site VPN on its security gateways. CVE-2026-85102 is an authentication-bypass flaw that can lead to unauthenticated remote code execution, while CVE-2026-85103 is a heap overflow in ASN.1 decoding that can corrupt memory and also result in RCE. Fixes are available via Jumbo Hotfix, with Check Point Live Patch rollout starting September 9, 2026; the vendor found and fixed the issues through internal research and reports no evidence of exploitation in the wild.

GBHackersupdated · 12h agofirst · 6d agoVulnerability 9 sourcesCVE-2026-85102CVE-2026-85103

CVE-2026-16232: Check Point SmartConsole Auth Bypass

Check Point SmartConsole authentication bypass CVE-2026-16232 grants unauthenticated attackers full admin access; actively exploited and added to CISA KEV.

CVE-2026-16232 is an improper authentication flaw (CWE-287) in the Check Point SmartConsole login process that lets an unauthenticated remote attacker obtain an application token and authenticate with full administrative privileges. Exploitation requires the Management Server to be internet-reachable and the Trusted Clients list not restricted to specific administrator addresses. Check Point confirmed active exploitation affecting a small number of customers, and the vulnerability has been added to the CISA Known Exploited Vulnerabilities catalog. A hotfix is available via Check Point advisory sk185169.

Web discovery (articles for new exploits & KEV entries) · 12d agoExploit / PoC in the wildCVE-2026-162321

Dutch NCSC Warns: Critical Check Point VPN Flaws Put Networks at Risk

Dutch NCSC warns two CVSS 9.8 Check Point VPN flaws enable unauthenticated RCE; patch and restrict access before exploitation begins.

The Dutch NCSC warns that CVE-2026-85102, a security-check bypass in the VPN negotiation process, and CVE-2026-85103, a heap overflow in the certificate ASN.1 decoder, both carry a CVSS score of 9.8 and allow unauthenticated remote code execution on Check Point Security Gateways and Security Management Servers. Check Point fixed the flaws on September 9 via advisories sk1000117 and sk1000118, covering R81.20, R82, R82.10, R81.10.x, R82.00.x plus end-of-support versions R80 through R81.10; R82.20 is unaffected. No public proof-of-concept exists, but the NCSC rates exploitation likelihood as high and recommends patching immediately via LivePatch Take 24 or Jumbo Hotfix and restricting VPN access to trusted IPs.

Security Affairsupdated · 12h agofirst · 2d agoVulnerability 9 sourcesCVE-2026-85102CVE-2026-85103

7th September – Threat Intelligence Report

Check Point weekly bulletin: exploited SonicWall SMA 1000 zero-days (CVE-2026-83548/49), JFrog Artifactory auth bypass, and a 2.8M-patient Baylor Genetics breach.

Check Point's weekly bulletin covers breaches including Thomson Reuters' C-Track platform (court records across 11 US states and Canada), Baylor Genetics (2.8M patients and employees, SSNs included), Hit casinos in Slovenia, and Dropbox (~5,000 accounts via abused Lenovo email verification). SonicWall patched two exploited SMA 1000 zero-days, including CVE-2026-83548, a CVSS 10.0 pre-authentication SSRF, while JFrog fixed exploited authentication bypass CVE-2026-82329 (CVSS 9.8). Malware and actor coverage includes Gambling Goblin, JSCeal, Mirage Kitten's NodeRabbit/PollCat campaign, and DPRK Contagious Interview macOS activity, plus a FalconFlank privilege-escalation PoC against CrowdStrike Falcon.

Check Point Research · 9d agoAdvisory in the wildCVE-2026-83548CVE-2026-83549CVE-2026-823291

LiteLLM Flaws Let Attackers Execute Code as Root and Steal Cloud Credentials

Wiz disclosed LiteLLM flaws including CVE-2026-59822 MCP auth bypass, now in CISA KEV, enabling root RCE and AWS credential theft from exposed gateways.

Wiz researchers disclosed weaknesses in the open-source LiteLLM AI gateway: CVE-2026-59821 allows authenticated administrators to execute code as root via the Custom Code Guardrails feature, while CVE-2026-59822 is an MCP authentication bypass where a meaningless Bearer token establishes a valid session. The MCP bypass was observed in the wild through Wiz honeypots and added to CISA's Known Exploited Vulnerabilities catalog on September 2. A scan of 3,074 internet-facing instances found 294 (9.6%) accepting the default master key sk-1234 or lacking authentication. Fixes shipped in LiteLLM 1.82.0 (guardrail hardening) and 1.84.0 (MCP bypass); exposed instances can leak provider API keys and temporary AWS IAM credentials via the pass-through feature and metadata service, with a related config-check issue tracked as CVE-2026-35029.

Cyber Security Newsupdated · 6d agofirst · 6d agoExploit / PoC in the wild 3 sourcesCVE-2026-59821CVE-2026-59822CVE-2026-35029

CVE-2026-34908: UniFi OS Auth Bypass Vulnerability

Ubiquiti disclosed CVE-2026-34908, a CVSS 10.0 authentication bypass in UniFi OS letting network-adjacent attackers alter device configuration without credentials.

CVE-2026-34908 is an improper access control flaw (CWE-284) in Ubiquiti UniFi OS devices, disclosed in UI Security Advisory Bulletin 064, with a CVSS 3.1 base score of 10.0. An unauthenticated network-adjacent attacker can bypass access controls and modify system configuration, with scope-changed impact on downstream network services such as routing, VPN, and connected access points. Fixed firmware is available, and workarounds include restricting management ports to trusted subnets, isolating management interfaces on a dedicated VLAN, and disabling remote access features. No public proof-of-concept code was observed at the time of publication.

Web discovery (articles for new exploits & KEV entries) · 8d agoVulnerabilityCVE-2026-34908

FBI Disrupts China-Linked QTFY Infrastructure Used to Steal Data From U.S. Organizations

FBI and Lumen disrupted QTFY's QScan and QTRouter botnet platforms used by Chinese state-sponsored hackers to conceal intrusions into U.S. agencies.

The U.S. DoJ announced court-authorized seizure of domains behind QScan and QTRouter, operated by the Chinese state-sponsored group QTFY and employed by Nanjing Xinjiuwei Network Technology Company. QTFY has been active since May 2018 and targeted NASA, the Federal Reserve, the Department of Energy, DoJ, HHS, NIH, the U.S. Senate, and academic institutions. QScan exploits vulnerable IoT devices, feeding them into QTRouter, an OpenWrt-based proxy obfuscation network likened to an operational relay box (ORB) that masks attack origins. The group exploited zero-days such as Ivanti CSA flaws CVE-2024-8190, CVE-2024-8963, and CVE-2024-9380, plus numerous N-days, and maintained persistence with RATs, web shells, and legitimate credentials.

The Hacker News · 14d agoThreat actor in the wildCVE-2018-13379CVE-2019-10068CVE-2019-19781+10 CVEs