Summary
Check Point Security Gateway and Check Point Spark Firewall using Site to Site VPN or Remote Access VPN contain an improper certificate validation vulnerability which could allow an unauthenticated remote attacker to execute arbitrary code on the Gateway.
- Vendor
- Check Point
- Product
- Multiple Products
- Added to KEV
- Sep 22, 2026
- Remediation due
- Sep 25, 2026 (US federal deadline)
- Ransomware use
- Not known
- Weakness
- CWE-295
- EPSS
- 54.1% as of Nov 10
In the news
- No Asia-Pacific article names this CVE yet.
Linked
Actors named alongside it:
none
Incidents exploiting it:
- none recorded
References