This weekly CVE report tracks 2,825 new flaws and 9 exploited vulnerabilities, verified against CISA KEV. WordPress, F5, Citrix and Check Point lead.

Related Posts:

• Weekly CVE Report: 4,378 New Flaws and 10 Exploited Bugs
• Daily Cybersecurity Flagged 9 Exploited Flaws Before CISA KEV
• Weekly CVE Report: Daily Cybersecurity Beats CISA KEV on Exploited Flaws

The post Weekly CVE Report: 2,825 New Flaws and 9 Exploited Bugs (Sept 21-27, 2026) appeared first on Daily CyberSecurity.

Check Point fixes an actively exploited flaw that lets unauthenticated attackers upload and run scripts on vulnerable Security Management Servers.

Check Point has released emergency hotfixes for CVE-2026-93616, a critical path traversal flaw in its Security Management Server. Attackers can abuse the flaw without logging in to upload malicious scripts and execute them on vulnerable servers.

Because the Management Server controls security policies, admin activity and system logs across Check Point deployments, a compromise could have a wider impact on an enterprise network.

The vulnerability affects more than Check Point’s main Security Management Server. The impacted products include Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent. Check Point fixed the issue in the R82.20 Security Hotfix and is urging customers to act quickly.

The company revealed the flaw “is exploited in the wild” and that it is aware of a handful of customers who have already been attacked. The actual number of victims could be higher, since some compromises may go undetected or never be reported to Check Point.

The company has also published indicators of compromise (IOCs) in its advisory, giving security teams a way to check their systems and logs for signs of an attack.

If the hotfix cannot be installed immediately, the cybersecurity firm recommends placing the vulnerable system behind a firewall and allowing access only from trusted IP addresses. This can be configured through Manage & Settings → Permissions & Administrators → Trusted Clients in SmartConsole. It is only a temporary measure, however.

Two weeks ago, the Dutch National Cyber Security Centre warned of two critical Check Point VPN flaws, tracked as CVE-2026-85102 and CVE-2026-85103, saying it expected exploitation attempts to start soon. In July, Check Point patched yet another critical authentication bypass, tracked as CVE-2026-16232, affecting Security Management and Multi-Domain Management (MDSM).

The vulnerability, which is under active exploitation, allows unauthenticated remote attackers to obtain a SmartConsole login token and gain full administrative access.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, BigDiskBuster)

Check Point fixed CVE-2026-91843, a critical flaw that could let attackers run code as root on Security Management and Log Servers with no login needed.

Check Point addressed CVE-2026-91843 (CVSS score of 9.8), a critical vulnerability in its Security Management and Log Servers. The flaw could let an attacker with no account run code as root over the network.

The flaw sits in the login process before authentication. Censys researchers found that an attacker can trigger the stack overflow by sending a login request with an extremely long username.

“This vulnerability may allow an unauthenticated attacker to remotely execute arbitrary code with root privileges through the login process.” reads the advisory. “At this time, there is no indication that this vulnerability has been exploited in the wild. However, due to its critical severity and potential impact, we strongly recommend taking immediate action to protect your environment.”

Check Point said the attack path works only when customers use the Trusted Clients setting, which controls access to the management server through SmartConsole.

Affected versions includes:

• R82.20
• R82.10 Jumbo Hotfix Take 44 or lower
• R82 Jumbo Hotfix Take 126 or lower
• R81.20 Jumbo Hotfix Take 166 or lower
• R81.10 Jumbo Hotfix Take 190 or lower (EoS)
• R80, R80.10, R80.20, R80.30, R80.40, R81 (all EoS)

Check Point released the fix through its LivePatch channel. Customers with automatic updates enabled should already have protection, while others need to apply the update described in advisory sk1000155. The company urged customers to act.

So far, Check Point is not aware of real-world exploitation of the flaw. Censys reported no public proof-of-concept exploit as of September 16.

Organizations should check their update status and apply the fix if required. These servers manage firewall and admin access, so teams should patch them quickly.

Organizations should apply the LivePatch fix described in sk1000155. Customers who have automatic updates enabled should already have the fix.

As an additional security measure, organizations should follow the recommendations in the Check Point Management and Gateway hardening best practices guide. They should also limit Trusted Clients access on the management server to specific, known internal IP addresses.

“Censys observes 3,836 hosts globally carrying the Security Management/Log Server role, identified by the Security Internal Communication (SIC) identity Check Point assigns management servers by default rather than by version, since build and Jumbo Hotfix level are not visible in passive scan data.” reads the advisory by Censys. “This figure is total role presence, not a confirmed-vulnerable count.”

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, CVE-2026-91843)

Check Point fixed a critical Check Point login flaw (CVE-2026-91843). Patch this Check Point login flaw now to block unauthenticated remote root takeovers.

Related Posts:

• Apache NiFi Vulnerabilities Expose Data Pipelines to Attacks
• Unbound DNS Vulnerabilities Expose Resolvers to RCE
• CVE-2026-89775 (CVSS 9.3): Linux Kernel LPE to Gain Root Flaw in KVM

The post Critical Check Point Login Flaw Enables Remote Takeover appeared first on Daily CyberSecurity.

Two critical Check Point VPN flaws score 9.8 and could enable remote code execution. Patch now and restrict VPN access before exploitation begins.

The Dutch NCSC warns that two critical vulnerabilities in Check Point VPN products, both rated CVSS score of 9.8, could soon be actively exploited. If you use Check Point VPN, you should patch it immediately.

CVE‑2026‑85102 resides in the VPN negotiation process and lets an unauthenticated attacker bypass security checks and run their own code on the gateway. CVE‑2026‑85103 is a heap overflow in the certificate ASN.1 decoder that also leads to remote code execution on Security Gateways and Security Management Servers.

Both vulnerabilities can be triggered by external attackers, and while no public proof‑of‑concept has surfaced yet, the NCSC explicitly rates the likelihood of exploitation and the potential damage as high.

“There are 2 critical vulnerabilities in Check Point VPN products with the attributes CVE-2026-85102 and CVE-2026-85103. These are 2 serious vulnerabilities with a CVSS score of 9.8.” reads the alert. “The NCSC assesses the likelihood of exploitation and potential damage as high and expects that attempts at exploitation will occur soon; therefore, the advice is to install the updates as soon as possible.”

An attacker can take over the system, read or change confidential data, and disrupt operations. In practice, that means your VPN appliance stops being a secure entry point and starts being a beachhead inside your network.

Check Point addressed the flaws on September 9 with the release of the advisories sk1000117 and sk1000118. The affected releases span R81.20, R82, R82.10, R81.10.x and R82.00.x, plus end‑of‑support versions from R80 through R81.10. R82.20 is not affected.

For supported versions, Check Point provides fixes through LivePatch Take 24 or specific Jumbo Hotfix updates, depending on the version you use.

If you use LivePatch with R81.20, R82 or R82.10, your system may already be protected without a reboot. However, you should check your setup to make sure. LivePatch does not cover every version or configuration, so don’t assume you are protected.

The NCSC’s advice is straightforward: install the updates as soon as possible. For organizations using Site‑to‑Site VPN, it also recommends tightening the ruleset: disable implied rules and restrict VPN access to specific, trusted IP addresses instead of leaving it wide open. If you’re not sure whether you’re running a vulnerable version, talk to your IT provider now, not after the first IOC shows up in your logs.

“The NCSC advises installing these updates as soon as possible. For organizations using Site-to-Site VPN, it is recommended to adjust certain VPN rules, such as disabling implied rules and restricting VPN access to specific IP addresses.” concludes the alert. “Contact your IT service provider if you are unsure whether you are using a vulnerable version. If necessary, ask for assistance in implementing the recommended measures.”

This isn’t a “schedule a change window next month” situation. It’s a “verify, patch, restrict, and move on before someone else decides your VPN is their new favorite initial access broker” kind of week.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Check Point)

ChatGPT entered Check Point’s top 10 phishing brand ranking as fake ChatGPT Plus payment failure emails targeted users’ credit card details.

The post ChatGPT Joins Most Faked Brands Ranking in Phishing, Check Point Says appeared first on TechRepublic.

An single threat actor used AI tools to create and run a campaign that compromised more then 600 Fortinet FortiGate appliances around the world over five weeks, according to Amazon threat researchers, the latest example of how cybercriminals are using the technology in their attacks.

The post Attacker Breached 600 FortiGate Appliances in AI-Assisted Campaign: Amazon appeared first on Security Boulevard.