30
Search: “Check Point Remote Access VPN”
80 stories
60
2026-012: Critical Vulnerabilities in Check Point Products
Check Point issued emergency hotfixes for two CVSS 9.8 flaws (CVE-2026-85102, CVE-2026-85103) enabling unauthenticated RCE on VPN-enabled gateways.
On 9 September 2026, Check Point released emergency security updates for CVE-2026-85102 (improper certificate-data validation in VPN negotiation) and CVE-2026-85103 (heap overflow in VPN certificate ASN.1 decoding), both CVSS 9.8, allowing unauthenticated remote code execution. The flaws affect Security Gateway, Security Management Server, and Spark Firewall deployments configured with Remote Access or Site-to-Site VPN, spanning versions R80 through R82.10. CERT-EU advisory 2026-012 urges immediate hotfix application, prioritizing internet-facing and perimeter appliances.
80
60
Cisco Issues Urgent Fix for ASA and FTD Software Vulnerability Under Active Attack
60
60
30
60
30
35
35
47
55
60
47
Critical Security Issue Affecting TeamCity On-Premises (CVE-2026-63077 ...
JetBrains fixed critical unauthenticated RCE CVE-2026-63077 in TeamCity On-Premises; update to 2025.11.7 or 2026.1.3.
JetBrains disclosed CVE-2026-63077, a critical unauthenticated remote code execution vulnerability affecting all TeamCity On-Premises versions. An attacker with HTTP(S) access can bypass authentication checks via the TeamCity agent polling protocol and execute arbitrary operating system commands with the privileges of the server process. Fixes are available in versions 2025.11.7 and 2026.1.3, plus a security patch plugin for TeamCity 2017.1+. JetBrains states there is no evidence of active exploitation at disclosure time, and TeamCity Cloud is already mitigated.
72
30
TP-Link Patches Four Omada Gateway Flaws, Two Allow Remote Code Execution
60
55
60
55
57
55
55
47
30
60
60
60
60
60
Week in review: 74k Fortinet firewall credentials stolen, Splunk Enterprise RCE under active attack
60
Microsoft Exchange Vulnerability CVE-2026-62911: What Administrators Should Do and How Zscaler Can Help
High-severity authentication bypass CVE-2026-62911 in Exchange Server has public exploit code; about 22,000 servers remain unpatched and internet-exposed.
Microsoft's August 2026 Patch Tuesday fixed CVE-2026-62911 (CVSS 8.0), an authentication bypass affecting Exchange Server 2016, 2019 and Subscription Edition. Successful exploitation lets an attacker with basic privileges take over all mailboxes on the targeted server, including reading and sending email and downloading attachments. As of September 1, Shadowserver identified roughly 22,000 unpatched, internet-exposed Exchange servers, including about 6,200 in the US and 5,100 in Germany. NCSC-NL confirmed working exploit code is publicly available, while CISA has not yet reported exploitation in the wild.
78
Researchers Observe In-the-Wild Exploitation of BeyondTrust CVSS 9.9 Vulnerability
60
60
35
60
30
⚡ Weekly Recap: AI-Powered Phishing, Android Spying Tool, Linux Exploit, GitHub RCE & More
60
CVE-2026-34908: UniFi OS Auth Bypass Vulnerability
Ubiquiti disclosed CVE-2026-34908, a CVSS 10.0 authentication bypass in UniFi OS letting network-adjacent attackers alter device configuration without credentials.
CVE-2026-34908 is an improper access control flaw (CWE-284) in Ubiquiti UniFi OS devices, disclosed in UI Security Advisory Bulletin 064, with a CVSS 3.1 base score of 10.0. An unauthenticated network-adjacent attacker can bypass access controls and modify system configuration, with scope-changed impact on downstream network services such as routing, VPN, and connected access points. Fixed firmware is available, and workarounds include restricting management ports to trusted subnets, isolating management interfaces on a dedicated VLAN, and disabling remote access features. No public proof-of-concept code was observed at the time of publication.
55