VulnHub

Check Point has reported that hackers are actively exploiting a serious vulnerability known as CVE-2026-85102, which allows for remote code execution (RCE) in the VPN certificate-handling feature of its Security Gateway product. This flaw is particularly concerning because it can be exploited without authentication, meaning attackers do not need a valid username or password to take advantage of it. Organizations using affected versions of the Security Gateway are at risk, as this vulnerability could allow attackers to execute malicious code remotely. Users are urged to take immediate action to secure their systems, as the exploitation is already happening in the wild. Ensuring that security measures are in place is crucial to prevent potential breaches.

On July 23, attackers exploited a zero-day vulnerability in Check Point's Security Management Server, identified as CVE-2026-93616. This flaw allows unauthorized users to execute scripts on the server's web service without needing to log in, posing a significant risk to organizations using this system. Check Point, which oversees firewall policies through this server, confirmed that the vulnerability was part of targeted attacks. To address this issue, the company released a patch on September 22, aimed at securing the affected systems. Organizations utilizing Check Point's Security Management Server should prioritize applying this update to mitigate potential exploitation.

Check Point Software has issued urgent hotfixes to fix a serious vulnerability in its Security Management Server. This flaw allows attackers to execute arbitrary scripts, which could potentially lead to unauthorized access and control of affected systems. The vulnerability has been actively exploited in the wild, putting various organizations at risk. Users of the Security Management Server need to apply the latest patches immediately to protect their infrastructure. This incident emphasizes the importance of timely updates in cybersecurity practices, especially for critical management systems.

CISA has updated its Known Exploited Vulnerabilities Catalog by adding four new vulnerabilities that are currently being exploited. These include issues affecting multiple Check Point products related to improper certificate validation and path traversal, an input validation flaw in the Arista VeloCloud Orchestrator, and a heap-based buffer overflow in F5's BIG-IP APM. These vulnerabilities can allow attackers to gain control over affected systems, posing serious risks, particularly to federal agencies. Under a new directive, federal agencies are urged to prioritize fixing these high-risk vulnerabilities, but CISA also encourages all organizations to adopt similar vulnerability management practices. If anyone is aware of additional exploited vulnerabilities not listed, CISA invites them to submit nominations for consideration.

Check Point Software has announced a significant security flaw that allows hackers to execute code with root privileges on management systems. This vulnerability poses a serious risk because it could enable attackers to gain complete control over affected systems, potentially compromising sensitive data and operations. The flaw affects various management systems provided by Check Point, but specific products and versions have not been disclosed. Users and organizations relying on these systems need to prioritize applying the security updates released by Check Point to mitigate this risk. The timely installation of these patches is crucial to prevent potential exploitation of the vulnerability.

Check Point has addressed a serious vulnerability identified as CVE-2026-91843, which allows attackers to execute code with root privileges on its Security Management and Log Servers without needing any authentication. This flaw has a CVSS score of 9.8, indicating its critical nature. If exploited, it could lead to unauthorized control over these servers, potentially compromising sensitive data and security measures. Organizations using Check Point's Security Management and Log Servers should prioritize applying the fix to safeguard their systems from potential attacks. The vulnerability emphasizes the importance of timely updates and security vigilance in protecting against unauthorized access.

Check Point has reported a serious vulnerability affecting its Security Management and Log Servers. This flaw could allow attackers to execute code remotely with root privileges, which poses a significant risk to users' systems. Organizations using these products should take immediate action to protect their environments. The potential for unauthorized access and control over sensitive data makes this a pressing concern for businesses relying on Check Point's security solutions. Users are advised to apply the necessary patches as soon as they become available to mitigate this risk.

A serious vulnerability has been discovered in Check Point's Security Management and Log Servers, which could let attackers bypass authentication and execute code as root remotely. This flaw affects systems that manage firewall policies and administrator access, potentially putting sensitive data and network security at risk. Check Point has addressed the issue with a fix available through its LivePatch update channel. While the company states there is no evidence that this vulnerability has been exploited in the wild, it is crucial for users to apply the patch promptly to safeguard their systems. This incident serves as a reminder of the importance of maintaining up-to-date security measures in network management.

Check Point has addressed two serious vulnerabilities in their VPN gateways, both rated at 9.8 on the severity scale. These flaws could potentially allow attackers to exploit the systems, but so far, there are no reports of them being actively exploited in the wild. Users of Check Point's VPN products should take this matter seriously, as unpatched vulnerabilities can lead to unauthorized access and data breaches. The company has released patches to fix these issues, and it is crucial for affected users to apply them promptly to secure their systems against potential threats.

Check Point has issued patches for two critical vulnerabilities tracked as CVE-2026-85102 and CVE-2026-85103. These vulnerabilities pose a significant risk as they could be exploited by attackers to execute code remotely, which could allow unauthorized access to affected systems. Organizations using Check Point's VPN solutions need to prioritize applying these patches to safeguard their networks. The potential for remote code execution means that if these vulnerabilities are exploited, attackers could gain control over sensitive data and systems, leading to serious security breaches. It’s crucial for users to stay informed and take action to mitigate the risks associated with these vulnerabilities.

Check Point has identified and patched two serious vulnerabilities in its firewall and management products related to VPN certificate handling. These flaws could allow remote attackers to execute code without authentication, but the company notes that this can only occur under specific conditions that it has not disclosed. The vulnerabilities impact Check Point's Security Gateways and firewall appliances, posing a significant risk to users who rely on these systems for secure communications. Given the potential for unauthorized code execution, it is important for affected users to apply the patches promptly to protect their networks. Organizations should stay vigilant and ensure their systems are updated to the latest versions to mitigate any risks associated with these vulnerabilities.

JSCeal is a new type of malware specifically designed to steal cryptocurrency, and it disguises its malicious code within V8 bytecode, making it particularly difficult for security researchers to analyze. Check Point Research has been monitoring this threat since early 2025 and recently developed a tool to decompile the bytecode, revealing the malware's sophisticated capabilities for theft. This means that users of cryptocurrency wallets and exchanges are at risk, as JSCeal can potentially compromise their funds. The ability of JSCeal to hide its operations poses a significant challenge for cybersecurity defenses, highlighting the need for enhanced security measures among crypto users. As this malware continues to evolve, vigilance is paramount for anyone dealing with cryptocurrencies.

Researchers have identified a new malware named JSCeal that targets Google authentication by stealing session cookies. This malware is particularly sophisticated, utilizing compiled V8 JavaScript and employing various obfuscation techniques to evade detection. It has capabilities for credential harvesting, surveillance, and traffic interception, making it a significant threat to user accounts and online security. The complexity of JSCeal means that it can effectively bypass standard security measures, which raises concerns for individuals and organizations relying on Google services. Users should remain vigilant and consider additional security measures to protect their accounts from potential exploitation.

A cybercrime group known as Gambling Goblin has been targeting Brazilian government and educational websites by installing malicious Apache modules on their servers. This operation, which Check Point Research has been tracking since mid-2025, redirects users from these sites to pages promoting online gambling and sports betting. The attackers are likely Chinese-speaking, and their activities raise concerns about the security of public web infrastructure in Brazil. This incident not only affects the integrity of government and educational institutions but also poses risks to users who may unknowingly interact with these compromised sites. The situation highlights the ongoing challenges in cybersecurity for public entities and the need for robust security measures.