Loading story…
Check Point released security updates to fix multiple vulnerabilities across Mobile Access, SSL VPN, Remote Access VPN, Spark Firewall, Security Gateways, and Multi-Domain Security Management. The most severe flaw, CVE-2026-50751 with a CVSS 9.3, is an authentication bypass issue in deprecated IKEv1 key exchange used for VPN Remote Access and Mobile Access, and Check Point said it is being exploited in the wild as a zero-day.
The update also addresses CVE-2026-50752, which affects certificate validation in deprecated IKEv1 site-to-site VPN connections and could allow man-in-the-middle attacks. Across the broader set of flaws, Check Point warned of risks including denial of service, data manipulation, authentication bypass, and unauthorized access, and urged organizations to apply patches as soon as testing is complete.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
In the June 9, 2026 security update, Check Point stated that CVE-2026-50751, a critical authentication bypass flaw in deprecated IKEv1 key exchange for VPN Remote Access and Mobile Access, is being exploited in the wild as a zero-day. The vulnerability was assigned a CVSS score of 9.3.
On June 9, 2026, Check Point released security updates to remediate multiple vulnerabilities affecting products including Mobile Access, SSL VPN, Remote Access VPN, Spark Firewall, Security Gateways, and Multi-Domain Security Management. The issues could enable denial-of-service, man-in-the-middle attacks, data manipulation, authentication bypass, and unauthorized access.
According to the new reference, exploitation of Check Point VPN authentication bypass flaw CVE-2026-50751 began on May 7, 2026. The activity reportedly compromised dozens of organizations before public disclosure.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
codeby.net
Open sourceegfincirt-wpn.azurewebsites.net
Open sourceegfincirt.org.eg
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Check Point disclosed **`CVE-2026-16232`**, a high-severity SmartConsole authentication bypass affecting **Security Management**, **Multi-Domain Management**, **Firewall**, and **Multi-Domain Log Server** products across multiple versions. The flaw, rated **CVSS 9.3**, allows attackers to bypass SmartConsole login using an application token, and Check Point said it has already been exploited against a small number of customers with specific exposed configurations. Check Point released fixes for `CVE-2026-16232` along with related flaws **`CVE-2026-62144`** and **`CVE-2026-62145`**, while the Canadian Centre for Cyber Security issued advisory **AV26-735** urging organizations to review the vendor guidance and apply mitigations. The highest risk is for management interfaces exposed directly to the internet without IP restrictions, and defenders were advised to install the available jumbo hotfix, restrict trusted GUI clients by IP address, and place management access behind a firewall until patching is complete.
Jul 30, 2026
Check Point disclosed and patched **`CVE-2024-24919`**, a critical information disclosure flaw affecting Internet-connected **Network Security Gateway** devices with **Remote Access VPN** or **Mobile Access** enabled. The vulnerability was traced to improper HTTP `POST` request validation that can enable directory traversal and arbitrary file reads by an unauthenticated attacker, allowing exposure of sensitive data from affected gateways. Check Point said it observed exploitation attempts in the wild, issued an initial mitigation, then released a mandatory hotfix and urged customers to apply it immediately. Reported abuse focused on remote-access environments, particularly older local VPN accounts using password-only authentication. Stolen data may include local account password hashes, private SSH keys, certificates, and potentially Active Directory-related files such as `ntds.dit`, creating follow-on risk of credential theft, lateral movement, broader network intrusion, and possible escalation toward remote code execution. Check Point and external responders advised organizations to disable unused local accounts, enforce stronger authentication such as MFA or certificates, rotate exposed credentials, and review gateway and authentication logs for signs of compromise.
Jul 24, 2026
Check Point released fixes for **CVE-2026-18574**, a critical authentication-bypass flaw in **Security Management Server** and **Multi-Domain Security Management Server (MDS)** that can let an unauthenticated remote attacker with network access to management services execute arbitrary commands. The vulnerability carries a **CVSS 4.0 score of 9.3** and is classified as **`CWE-288`**, with impact that can extend to full compromise of the security management environment. Check Point said it discovered the issue internally and reported no evidence of active exploitation, while noting that **Smart-1 Cloud** customers are already protected. Supported affected versions include **R81.20, R82, and R82.10**, with older affected releases from **R80 through R81.10** now end-of-support; fixes were issued through **Jumbo Hotfix Accumulator** updates. The company urged customers to apply patches, restrict **Trusted Clients**, limit management access to trusted administrator systems, avoid exposing management interfaces to untrusted networks or the public internet, and monitor for unauthorized activity.
Aug 8, 2026