erroneo.us
Search all guides⌘K

Digest · Wednesday

Security digest: September 9, 2026

1 editorial brief, 4 known exploited (cisa kev) additions and 1 critical advisory.

All digests · RSS · Markdown

Take stock

  • Act now: Check Point: Exploited VPN Gateway and Management RCEs. Anyone running Check Point Security Gateways or Spark firewalls with Remote Access VPN or certificate-based Site-to-Site VPN, and anyone running on-prem Security Management, Multi-Domain, Log or SmartEvent servers.
  • Do you run any of these? Google Chromium V8, Cisco Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management, Citrix NetScaler, Fortinet Multiple Products. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-09-12.
  • Maven: 1 critical advisory (org.freemarker:freemarker). Check with mvn dependency:tree -Dincludes=<groupId>:<artifactId>.
  • None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Act now

· Vulnerability · CVE-2026-85102, CVE-2026-93616

Check Point: Exploited VPN Gateway and Management RCEs

Check Point shops should patch both gateways and management servers now: each flaw is unauthenticated RCE, both are exploited, and fixing one tier does not fix the other.

Must act: Anyone running Check Point Security Gateways or Spark firewalls with Remote Access VPN or certificate-based Site-to-Site VPN, and anyone running on-prem Security Management, Multi-Domain, Log or SmartEvent servers.

Can relax: Smart-1 Cloud customers (already fixed for the management bug), R82.20 gateways (not affected by the VPN bug), gateways that only use pre-shared-key Site-to-Site VPN with no Remote Access VPN, and non-Check Point shops.

  1. Inventory every gateway, Spark appliance and management, log and SmartEvent server, with version and Jumbo Hotfix take.
  2. Patch gateways with LivePatch Take 26 or the fixed Jumbo Hotfix, then confirm with cplp list that CVE-2026-85102 and CVE-2026-85103 are covered.
  3. Update Spark firewalls to R82.00.10 Build 2325 or R81.10.17 Build 4968.

Read the brief →

Known exploited (CISA KEV) 4

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

CVEProduct and flawCISA due
CVE-2026-87491Google Chromium V8
Google Chromium V8 Out of Bounds Write Vulnerability		2026-09-23
CVE-2026-20079Cisco Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management
Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerability		2026-09-12
CVE-2026-19490Citrix NetScaler
Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability		2026-09-12
CVE-2025-25249Fortinet Multiple Products
Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability		2026-09-12

Critical advisories by ecosystem 1

GitHub-reviewed advisories rated critical, published this day (Pacific time).

Maven 1

Check: mvn dependency:tree -Dincludes=<groupId>:<artifactId>