Last updated: 2026-09-22T20:07:55Z
CVSSv3: 9.8
What’s Happening
In what’s-old-is-new-again news, two CVEs were released today for Checkpoint Security Gateway management toolsets, including a pre-auth remote code execution and a path traversal in the management web service.
Here are Check Points internal support center details:
Since I started writing this Check Point posted notification of exploitation on their blog.
Both CVEs have been added to CISA KEV.
Actions
Check the advisories above for affected versions and observables/indicators. Patch if impacted, and hunt on the listed observables.
Notes
Directory traversal vulnerabilities will be with us until the end of civilization.
