Advisories
Check Point Urges Immediate Patch for Dual 9.8‑Score Vulnerabilities
On September 9 2026, Check Point issued emergency updates for its Security Gateway, Security Management Server, and Spark Firewall. Two critical flaws—both rated 9.8 on CVSS—enable unauthenticated remote code execution on devices running Remote Access or Site‑to‑Site VPN. CERT‑EU urges rapid deployment of the hotfixes, focusing first on internet‑facing and perimeter appliances.
Check Point’s latest advisory warns that two newly disclosed vulnerabilities could be leveraged by attackers to take full control of affected VPN appliances. Both flaws carry a CVSS score of 9.8 and are exploitable from outside the network without authentication.
What’s at risk?
- Check Point Security Gateway
- Check Point Security Management Server
- Check Point Spark Firewall
The weaknesses are only triggered when the appliance is configured for Remote Access VPN or Site‑to‑Site VPN. Once exploited, an attacker can run arbitrary code, effectively compromising the entire device.
Immediate action required
Check Point has released hotfixes for all affected firmware versions. CERT‑EU recommends that organizations apply the patches as soon as possible, prioritising devices that sit on the perimeter or are exposed to the internet.
“The combination of high severity and remote‑only exploitation means these vulnerabilities pose an urgent threat to all VPN deployments,” the advisory states.
Failure to patch could leave critical infrastructure vulnerable to takeover, data exfiltration, or further lateral movement within the network.
Related vulnerabilities
Digital Watchdog VMAX Devices Hit by Critical Authentication Bypass – Firmware Update Urgently Needed
All firmware versions of Digital Watchdog’s VMAX DVR and NVR lineup now suffer from a series of authentication bypass flaws that let attackers gain full administrative control, view live and recorded footage, alter settings, and even use the device as a pivot point. The CVSS score for the combined issue is 6.5 (medium). Immediate patching is required for every VMAX model in use.
Read briefing
Wärtsilä FOS‑Onboard Faces Dual Hard‑Coded Key Vulnerabilities (CVE‑2026‑78225, CVE‑2026‑81855)
Two critical CVEs expose hard‑coded cryptographic keys in Wärtsilä FOS‑Onboard 5.07.0923.01, allowing attackers to push unauthorized updates, execute code or steal credentials. With a CVSS score of 9.1, the flaws threaten transportation‑system operators worldwide. Wärtsilä has released a patch; users must contact the vendor to apply it immediately.
Read briefing
Dutch NCSC Warns of Imminent Exploitation of Critical Check Point VPN Flaws
The Dutch NCSC has issued an urgent advisory that two critical vulnerabilities in Check Point VPN—CVE‑2026‑85102 and CVE‑2026‑85103—are likely to be exploited soon. Although no public proof‑of‑concept exists, the agency stresses that the flaws could let attackers execute arbitrary code on Security Gateways and Management Servers, potentially taking full control of affected networks. Check Point released patches on September 9, and the NCSC urges organizations to apply them immediately or use LivePatch. For Site‑to‑Site VPN users, limiting access to trusted IPs is also recommended.
Read briefing
Cisco ISE Zero‑Day Exploited in the Wild – Immediate Patch Required
Cisco’s Identity Services Engine (ISE) is under attack. The CVE‑2026‑76460 vulnerability, rated maximum severity, lets remote actors bypass authentication by sending crafted API requests. Cisco has released fixed releases for ISE and ISE‑PIC, but no workarounds exist. The company urges customers to apply the patch immediately, and CISA has added the flaw to its Known Exploited Vulnerabilities catalog, mandating federal agencies patch within three days.
Read briefing