Check Point
Check Point Revises Management Server RCE Advisory for Active Exploitation
Check Point reports active exploitation of unauthenticated file upload and script execution on management and log servers. Restrict management access, apply the branch-specific hotfix, and investigate compromise; Firewall Appliance and Spark products are outside this scope.
CVE-2026-50751: Check Point deprecated IKEv1 VPN authentication bypass
Check Point's exploited VPN bypass requires Remote Access or Mobile Access, IKEv1, accepted legacy clients and no mandatory machine certificate. Gateway and Spark remediation differ; review suspicious VPN sessions separately from installing the appropriate fix.
CVE-2026-16232: Check Point SmartConsole token bypass to full administrator
The SmartConsole flaw can give an unauthenticated attacker a full-administrator login token. Restrict management exposure and Trusted Clients, preserve evidence, and install the Jumbo Hotfix Accumulator take for the deployed Check Point branch.
Check Point Confirms Active Exploitation of VPN RCE CVE-2026-85102
Check Point reports active exploitation of a pre-authentication VPN certificate-handling flaw. Match Security Gateway or Spark builds to the supported fix, preserve logs, and investigate suspicious Mobile Access logins separately from patch installation.